ruby-sdk vulnerabilities

2 known vulnerabilities in ruby-sdk from Modelcontextprotocol. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  ruby-sdk: Allocation of Resources Without Limits or Throttling

  CVE-2026-67432Jul 29, 2026Modelcontextprotocol

  MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticat

• 8.3 High severity

  ruby-sdk: Improper Access Control

  CVE-2026-67431Jul 29, 2026Modelcontextprotocol

  MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID