Skip to content

Commit 0a5bc60

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@e814c84 
1 parent 5161c2f commit 0a5bc60

5 files changed

Lines changed: 277 additions & 0 deletions

File tree

‎advisories/_posts/2026-07-07-CVE-2026-63118.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-63118 (mcp): Streamable HTTP transport lacks DNS-rebinding (Host/Origin)
4+
protection'
5+
comments: false
6+
categories:
7+
- mcp
8+
advisory:
9+
gem: mcp
10+
cve: 2026-63118
11+
ghsa: rjr6-rcgv-9m7m
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-63118
13+
title: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
14+
date: 2026-07-07
15+
description: |-
16+
## Summary
17+
18+
MCP::Server::Transports::StreamableHTTPTransport (the Rack-mountable
19+
Streamable HTTP transport in the mcp gem) processes every incoming
20+
JSON-RPC request without ever inspecting the HTTP Host or Origin
21+
request headers. There is no AllowedHosts/AllowedOrigins allowlist
22+
and no DNS-rebinding guard anywhere in the transport. A local MCP
23+
server that binds a loopback or LAN HTTP port is therefore reachable
24+
by any web origin a victim's browser visits, via a DNS-rebinding
25+
attack: a malicious page rebinds its own hostname to 127.0.0.1, then
26+
drives the local MCP server cross-origin to enumerate and invoke
27+
its tools and exfiltrate their output. This is the standard browser-driven
28+
local-service attack that the MCP Streamable HTTP guidance exists to prevent.
29+
30+
## Impact
31+
32+
An attacker who can get a victim to open a web page can reach any MCP
33+
server the victim runs locally over the Streamable HTTP transport
34+
(e.g. a developer-tools or filesystem MCP server on localhost).
35+
Because the transport issues a session and dispatches tools/list/
36+
tools/call from a foreign Host/Origin with no rejection, the attacker
37+
can drive arbitrary server-exposed tools and read their results,
38+
exfiltrating local data (files, secrets, command output) to the
39+
attacker's origin.
40+
The blast radius is whatever the locally-running MCP server exposes.
41+
For MCP servers wired to filesystem, shell, or credential tools,
42+
this is sensitive-data disclosure and, depending on the tool set,
43+
local action execution.
44+
45+
## Credit
46+
47+
Reported by tonghuaroot.
48+
cvss_v4: 6.9
49+
patched_versions:
50+
- ">= 0.23.0"
51+
related:
52+
url:
53+
- https://nvd.nist.gov/vuln/detail/CVE-2026-63118
54+
- https://rubygems.org/gems/mcp/versions/0.23.0
55+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
56+
- https://github.com/modelcontextprotocol/ruby-sdk/commit/ba543083a7594e7892b29464b89091816446ff7a
57+
- https://advisories.gitlab.com/gem/mcp/CVE-2026-63118
58+
- https://osv.dev/vulnerability/GHSA-rjr6-rcgv-9m7m
59+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m
60+
- https://github.com/advisories/GHSA-rjr6-rcgv-9m7m
61+
notes: |
62+
- date from gem release
63+
- cvss_v4 from GHSA and nvd.nist.gov URL
64+
- From GHSA: "Reporter notes: This issue was found by source review of
65+
the `mcp` gem's Streamable HTTP transport and confirmed end-to-end
66+
against the released gem `mcp` 0.18.0 as shown above. It is
67+
reported independently on its own merits."
68+
---

‎advisories/_posts/2026-07-07-CVE-2026-63119.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-63119 (mcp): Unbounded line buffer in stdio transports leads to memory
4+
exhaustion (DoS)'
5+
comments: false
6+
categories:
7+
- mcp
8+
advisory:
9+
gem: mcp
10+
cve: 2026-63119
11+
ghsa: 7683-3w9x-ch42
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-63119
13+
title: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
14+
date: 2026-07-07
15+
description: |-
16+
## Summary
17+
18+
The stdio transports in MCP::Server::Transports::StdioTransport and
19+
MCP::Client::Stdio read newline-delimited JSON-RPC frames using
20+
IO#gets with no limit argument. CRuby's IO#gets with no limit reads
21+
from the current position until the next separator (\n) with no upper
22+
bound on the returned string length. A peer that streams bytes without
23+
ever emitting a newline causes gets to accumulate the entire stream
24+
in a single Ruby String until the process is killed by the
25+
operating-system OOM killer.
26+
27+
## Credit
28+
29+
Reported by tonghuaroot
30+
31+
Identified during a cross-SDK audit of the stdio unbounded-buffer
32+
vulnerability class, prompted by GHSA-74gp-qhv5-v493.
33+
cvss_v3: 6.2
34+
patched_versions:
35+
- ">= 0.23.0"
36+
related:
37+
url:
38+
- https://nvd.nist.gov/vuln/detail/CVE-2026-63119
39+
- https://rubygems.org/gems/mcp/versions/0.23.0
40+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
41+
- https://docs.ruby-lang.org/en/3.3/IO.html#method-i-gets
42+
- https://github.com/modelcontextprotocol/ruby-sdk/commit/267b8fa6285453525c81ce43db6b7dcd7a8a8c2f
43+
- https://advisories.gitlab.com/gem/mcp/CVE-2026-63119
44+
- https://osv.dev/vulnerability/GHSA-7683-3w9x-ch42
45+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42
46+
notes: |
47+
- cvss_v3 from GHSA
48+
- date from gem release
49+
---

‎advisories/_posts/2026-07-07-CVE-2026-67430.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-67430 (mcp): Unbounded session retention in StreamableHTTPTransport
4+
allows memory exhaustion via initialize flood'
5+
comments: false
6+
categories:
7+
- mcp
8+
advisory:
9+
gem: mcp
10+
cve: 2026-67430
11+
ghsa: 52jp-gj8w-j6xh
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-67430
13+
title: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion
14+
via initialize flood
15+
date: 2026-07-07
16+
description: |-
17+
## Summary
18+
19+
In its default configuration, MCP::Server::Transports::StreamableHTTPTransport
20+
never expires sessions. Every successful initialize request stores a
21+
new ServerSession and a session record under a fresh UUID, and the
22+
only path that removes them is an explicit client-issued HTTP DELETE.
23+
An unauthenticated attacker can repeatedly initialize new sessions
24+
and immediately disconnect, forcing the server to retain an unbounded
25+
number of ServerSession objects until memory is exhausted.
26+
27+
## Impact
28+
29+
- **Attacker requirements:** unauthenticated TCP reach of the MCP
30+
endpoint. No session, no credentials.
31+
32+
- **Effect:** memory-exhaustion denial of service. A sustained or
33+
distributed attacker can OOM the worker; on services that recycle
34+
workers, the attacker simply repeats. On multi-tenant gateways, one
35+
tenant can starve all others.
36+
37+
- **Affected deployments:** every deployment that does not opt into
38+
`session_idle_timeout`. Because the README presents this as an
39+
opt-in mitigation rather than a default, real-world deployments
40+
are likely to ship vulnerable.
41+
cvss_v3: 5.3
42+
patched_versions:
43+
- ">= 0.23.0"
44+
related:
45+
url:
46+
- https://nvd.nist.gov/vuln/detail/CVE-2026-67430
47+
- https://rubygems.org/gems/mcp/versions/0.23.0
48+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
49+
- https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4
50+
- https://advisories.gitlab.com/gem/mcp/CVE-2026-67430
51+
- https://osv.dev/vulnerability/GHSA-52jp-gj8w-j6xh
52+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
53+
- https://github.com/advisories/GHSA-52jp-gj8w-j6xh
54+
notes: |
55+
- cvss_v3 from GHSA
56+
- date from gem release
57+
---

‎advisories/_posts/2026-07-07-CVE-2026-67431.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-67431 (mcp): MCP Ruby SDK - Ruby SSE Session Poisoning'
4+
comments: false
5+
categories:
6+
- mcp
7+
advisory:
8+
gem: mcp
9+
cve: 2026-67431
10+
ghsa: 5p9g-j988-pcwv
11+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-67431
12+
title: MCP Ruby SDK - Ruby SSE Session Poisoning
13+
date: 2026-07-07
14+
description: |-
15+
## Summary
16+
17+
Vulnerability: Missing Session Ownership Validation in the Ruby MCP
18+
SDK's Streamable and SSE HTTP transport implementation. Any attacker
19+
with a stolen session ID can execute tools with the victim's session.
20+
This is a silent attack - the victim's session is compromised and
21+
being used for unauthorized actions, but it is hard to know for the victim.
22+
23+
## Impact
24+
25+
- **Integrity:** HIGH - Attacker can execute unauthorized tools and
26+
modify state.
27+
28+
- **Availability:** LOW - Attacker can disrupt victim's session with
29+
injected responses.
30+
cvss_v4: 8.3
31+
patched_versions:
32+
- ">= 0.23.0"
33+
related:
34+
url:
35+
- https://nvd.nist.gov/vuln/detail/CVE-2026-67431
36+
- https://rubygems.org/gems/mcp/versions/0.23.0
37+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
38+
- https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356
39+
- https://advisories.gitlab.com/gem/mcp/CVE-2026-67431
40+
- https://osv.dev/vulnerability/GHSA-5p9g-j988-pcwv
41+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv
42+
- https://github.com/advisories/GHSA-5p9g-j988-pcwv
43+
notes: |
44+
- cvss_v4 from GHSA; Project GHSA has high severity.
45+
- date from gem release
46+
---

‎advisories/_posts/2026-07-07-CVE-2026-67432.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-67432 (mcp): Unbounded JSON-RPC request body causes uncontrolled
4+
memory allocation in StreamableHTTPTransport'
5+
comments: false
6+
categories:
7+
- mcp
8+
advisory:
9+
gem: mcp
10+
cve: 2026-67432
11+
ghsa: h669-8m4g-r2hc
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-67432
13+
title: Unbounded JSON-RPC request body causes uncontrolled memory allocation in
14+
StreamableHTTPTransport
15+
date: 2026-07-07
16+
description: |-
17+
## Summary
18+
19+
An unauthenticated remote attacker can force any MCP Ruby SDK server
20+
using MCP::Server::Transports::StreamableHTTPTransport to allocate
21+
gigabytes of memory by sending a single oversized JSON-RPC POST. The
22+
transport reads the entire HTTP body into a Ruby String and parses
23+
it with JSON.parse(body, symbolize_names: true) with no size limit,
24+
no Content-Length pre-check, and no streaming parser, allowing
25+
trivial denial of service against the worker process.
26+
27+
## Impact
28+
29+
- **Attacker requirements:** none beyond TCP reach of the MCP
30+
endpoint. No session, no credentials, no prior interaction.
31+
32+
- **Effect:** memory-exhaustion denial of service. A single request
33+
can take a worker offline; sustained low-rate requests keep the
34+
service down across worker restarts. On multi-tenant deployments a
35+
single attacker tenant can starve neighbours.
36+
37+
- **Affected deployments:** every server mounting
38+
`MCP::Server::Transports::StreamableHTTPTransport` as a Rack
39+
app — the canonical HTTP deployment pattern. Both stateful
40+
and `stateless: true` configurations are affected.
41+
cvss_v3: 7.5
42+
patched_versions:
43+
- ">= 0.23.0"
44+
related:
45+
url:
46+
- https://nvd.nist.gov/vuln/detail/CVE-2026-67432
47+
- https://rubygems.org/gems/mcp/versions/0.23.0
48+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
49+
- https://github.com/modelcontextprotocol/ruby-sdk/commit/772e0cb1f9db69312006926eee59a7287ad50166
50+
- https://advisories.gitlab.com/gem/mcp/CVE-2026-67432
51+
- https://osv.dev/vulnerability/GHSA-h669-8m4g-r2hc
52+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc
53+
- https://github.com/advisories/GHSA-h669-8m4g-r2hc
54+
notes: |
55+
- cvss_v3 from GHSA
56+
- date from gem release
57+
---

0 commit comments

Comments
 (0)