DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-67432: CVE-2026-67432: High Severity Denial of Service in Model Context Protocol (MCP) Ruby SDK

#security #cve #cybersecurity

CVE-2026-67432: High Severity Denial of Service in Model Context Protocol (MCP) Ruby SDK

Vulnerability ID: CVE-2026-67432
CVSS Score: 7.5
Published: 2026-07-30

An uncontrolled memory allocation vulnerability (CWE-770) exists in the Model Context Protocol (MCP) Ruby SDK (the mcp gem) prior to version 0.23.0. The SDK's StreamableHTTPTransport and StdioTransport layers fail to impose bounds on incoming payloads. An unauthenticated attacker can exploit these issues by transmitting massive, nested payloads to exhaust worker memory, leading to process termination.

TL;DR

The mcp Ruby gem prior to 0.23.0 is vulnerable to unauthenticated, remote denial of service (OOM crash) due to unbounded HTTP body reading, unsafe JSON parsing depth, and unlimited standard input buffering.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-770
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: 0.00436 (35.87%)
  • Impact: Denial of Service (OOM Crash)
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • Model Context Protocol Ruby SDK (mcp gem)
  • mcp: < 0.23.0 (Fixed in: 0.23.0)

Code Analysis

Commit: 772e0cb

Implement bounded payload reads and nesting limits for StreamableHTTPTransport and StdioTransport layers.

Mitigation Strategies

  • Upgrade the mcp gem to 0.23.0 or higher.
  • Configure application firewalls to drop payload sizes over a safe limit (e.g. 4MB).
  • Configure limits programmatically when initializing HTTP and Stdio transports.

Remediation Steps:

  1. In Gemfile, replace existing gem declaration with: gem 'mcp', '>= 0.23.0'
  2. Run 'bundle update mcp' to apply the patch.
  3. Validate application starts successfully and transport initializations are supplied with explicit size configurations if custom thresholds are needed.

References

Read the full report for CVE-2026-67432 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)