modelcontextprotocol/ruby-sdk Security Advisories | GitStock

high2026-07-30

MCP Ruby SDK: Ruby SSE Session Poisoning

GHSA-5p9g-j988-pcwv · CVE-2026-67431

high2026-07-30

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

GHSA-h669-8m4g-r2hc · CVE-2026-67432

medium2026-07-30

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

GHSA-52jp-gj8w-j6xh · CVE-2026-67430

medium2026-07-30

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

GHSA-7683-3w9x-ch42 · CVE-2026-63119

medium2026-07-30

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

GHSA-rjr6-rcgv-9m7m · CVE-2026-63118

high2026-03-27

MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

GHSA-qvqr-5cv7-wh35 · CVE-2026-33946