CVE-2026-67430

RubyGems/mcp CVE-2026-67430: medium 5.3, EPSS 0.51%

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

Action: Upgrade mcp to 0.23.0 or later.

bundle update mcp

Affected

Fixed versions

Sources

• osv: GHSA-52jp-gj8w-j6xh
• https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
• https://nvd.nist.gov/vuln/detail/CVE-2026-67430
• https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4
• https://github.com/modelcontextprotocol/ruby-sdk
• https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0

CVE-2026-67430 · published 2026-07-30T14:43:29Z · modified 2026-07-30T15:00:31.152089988Z · JSON