{"uuid": "759f23b0-771d-4bde-936d-1d00d7b13c82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67432", "type": "seen", "source": "https://gist.github.com/alon710/0adfedd2017833afe3a395108d8a9b0f", "content": "# CVE-2026-67432: CVE-2026-67432: High Severity Denial of Service in Model Context Protocol (MCP) Ruby SDK\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67432\n\n## Summary\nAn uncontrolled memory allocation vulnerability (CWE-770) exists in the Model Context Protocol (MCP) Ruby SDK (the `mcp` gem) prior to version 0.23.0. The SDK's StreamableHTTPTransport and StdioTransport layers fail to impose bounds on incoming payloads. An unauthenticated attacker can exploit these issues by transmitting massive, nested payloads to exhaust worker memory, leading to process termination.\n\n## TL;DR\nThe `mcp` Ruby gem prior to 0.23.0 is vulnerable to unauthenticated, remote denial of service (OOM crash) due to unbounded HTTP body reading, unsafe JSON parsing depth, and unlimited standard input buffering.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00436 (35.87%)\n- **Impact**: Denial of Service (OOM Crash)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol Ruby SDK (mcp gem)\n- **mcp**: < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the mcp gem to 0.23.0 or higher.\n- Configure application firewalls to drop payload sizes over a safe limit (e.g. 4MB).\n- Configure limits programmatically when initializing HTTP and Stdio transports.\n\n**Remediation Steps:**\n1. In Gemfile, replace existing gem declaration with: gem 'mcp', '>= 0.23.0'\n2. Run 'bundle update mcp' to apply the patch.\n3. Validate application starts successfully and transport initializations are supplied with explicit size configurations if custom thresholds are needed.\n\n## References\n\n- [GitHub Advisory GHSA-h669-8m4g-r2hc](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc)\n- [Security Fix Commit](https://github.com/modelcontextprotocol/ruby-sdk/commit/772e0cb1f9db69312006926eee59a7287ad50166)\n- [v0.23.0 Release Notes](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-67432)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67432)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67432) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T03:34:09.041044Z"}