PT-2026-65897 · Modelcontextprotocol · Ruby-Sdk

CVE-2026-67430 · Publicado 2026-07-29 · Atualizado 2026-07-29

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

Correção

Memory Leak

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-401

CWE-770

Identificadores relacionados

CVE-2026-67430

Produtos afetados

Ruby-Sdk

Referências · 4

• https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh · Nota
• https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4 · Nota
• https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67430 · Nota de Segurança