PT-2026-65897 · Modelcontextprotocol · Ruby-Sdk

CVE-2026-67430 · Published 2026-07-29 · Updated 2026-07-29

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

Fix

Memory Leak

Allocation of Resources Without Limits

Weakness Enumeration

CWE-401

CWE-770

Related Identifiers

CVE-2026-67430

Affected Products

Ruby-Sdk

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-67430 · Security Note
• https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh · Note
• https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4 · Note
• https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 · Note