CVE-2026-63119: Denial of Service via Uncontrolled Resource Consumption in Model Context Protocol Ruby SDK
Vulnerability ID: CVE-2026-63119
CVSS Score: 6.2
Published: 2026-07-30
CVE-2026-63119 is a high-impact denial-of-service vulnerability in the Model Context Protocol (MCP) Ruby SDK (distributed as the 'mcp' gem) before version 0.23.0. The vulnerability allows an attacker to cause resource exhaustion and process termination by streaming unbounded input to standard I/O streams.
TL;DR
Unbounded standard input stream reading in the Model Context Protocol Ruby SDK allows connected peers or subprocesses to deplete system memory and crash the host application via a continuous stream of data lacking newline separators.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400 / CWE-770
- Attack Vector: Local (AV:L)
- CVSS v3.1 Score: 6.2
- EPSS Score: 0.00129
- Impact Type: Availability (High)
- Exploit Status: Proof of Concept Available
- KEV Status: Not Listed
Affected Systems
- Model Context Protocol (MCP) Ruby SDK prior to version 0.23.0
-
modelcontextprotocol/ruby-sdk: < 0.23.0 (Fixed in:
0.23.0)
Code Analysis
Commit: 267b8fa
Limit the maximum line bytes read from stdin/stdout to prevent OOM errors
@@ -239,7 +254,7 @@ def read_response(request)...
Commit: 772e0cb
Cap incoming HTTP request bodies at 4 MiB on StreamableHTTPTransport
@@ -71,7 +71,7 @@ def handle_post_request...
Exploit Details
- Vulnerability Context: Proof of concept showcasing an unpatched client reading data without newline delimiters from standard output
Mitigation Strategies
- Upgrade the 'mcp' Ruby gem to version 0.23.0 or higher
- Enforce explicit byte-limit configurations on all standard input/output stream readers
- Discard and re-initialize transport objects immediately if a stream handler error is raised
Remediation Steps:
- Open the project's Gemfile
- Update the 'mcp' gem definition to require version '>= 0.23.0'
- Run 'bundle update mcp' to install the patched library version
- Restart any running client or server instances utilizing the SDK
References
- NVD - CVE-2026-63119 Detail
- CVE.org CVE-2026-63119 Record
- GitHub Security Advisory GHSA-7683-3w9x-ch42
- MCP Ruby SDK Release v0.23.0 Notes
Read the full report for CVE-2026-63119 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)