{"uuid": "b7a63643-0e34-4dfc-86dd-f6eba73c3ec9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-7683-3w9x-ch42", "type": "seen", "source": "https://gist.github.com/alon710/14986c8aa9f0de6cc9812b6e85b52624", "content": "# CVE-2026-63119: CVE-2026-63119: Denial of Service via Uncontrolled Resource Consumption in Model Context Protocol Ruby SDK\n\n> **CVSS Score:** 6.2\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63119\n\n## Summary\nCVE-2026-63119 is a high-impact denial-of-service vulnerability in the Model Context Protocol (MCP) Ruby SDK (distributed as the 'mcp' gem) before version 0.23.0. The vulnerability allows an attacker to cause resource exhaustion and process termination by streaming unbounded input to standard I/O streams.\n\n## TL;DR\nUnbounded standard input stream reading in the Model Context Protocol Ruby SDK allows connected peers or subprocesses to deplete system memory and crash the host application via a continuous stream of data lacking newline separators.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-770\n- **Attack Vector**: Local (AV:L)\n- **CVSS v3.1 Score**: 6.2\n- **EPSS Score**: 0.00129\n- **Impact Type**: Availability (High)\n- **Exploit Status**: Proof of Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol (MCP) Ruby SDK prior to version 0.23.0\n- **modelcontextprotocol/ruby-sdk**: < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the 'mcp' Ruby gem to version 0.23.0 or higher\n- Enforce explicit byte-limit configurations on all standard input/output stream readers\n- Discard and re-initialize transport objects immediately if a stream handler error is raised\n\n**Remediation Steps:**\n1. Open the project's Gemfile\n2. Update the 'mcp' gem definition to require version '>= 0.23.0'\n3. Run 'bundle update mcp' to install the patched library version\n4. Restart any running client or server instances utilizing the SDK\n\n## References\n\n- [NVD - CVE-2026-63119 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-63119)\n- [CVE.org CVE-2026-63119 Record](https://www.cve.org/CVERecord?id=CVE-2026-63119)\n- [GitHub Security Advisory GHSA-7683-3w9x-ch42](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42)\n- [MCP Ruby SDK Release v0.23.0 Notes](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63119) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T05:31:42.225656Z"}