MEDIUM5.3RubyGems
GHSA-52jp-gj8w-j6xh· CVE-2026-67430MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
Modified: 7/30/2026
package
RubyGems/mcp
pkg:rubygems/mcp
HIGHRubyGems
GHSA-5p9g-j988-pcwv· CVE-2026-67431MCP Ruby SDK: Ruby SSE Session Poisoning
Modified: 7/30/2026
MEDIUM6.2RubyGems
GHSA-7683-3w9x-ch42· CVE-2026-63119MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
Modified: 7/30/2026
HIGH7.5RubyGems
GHSA-h669-8m4g-r2hc· CVE-2026-67432MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
Modified: 7/30/2026
HIGHRubyGems
GHSA-qvqr-5cv7-wh35· CVE-2026-33946MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
Modified: 3/30/2026
MEDIUMRubyGems
GHSA-rjr6-rcgv-9m7m· CVE-2026-63118MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
Modified: 7/30/2026