Skip to content

Commit 2758cff

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@817e2c4 
1 parent d13b637 commit 2758cff

5 files changed

Lines changed: 193 additions & 0 deletions

‎advisories/_posts/2026-07-07-GHSA-52jp-gj8w-j6xh.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-52jp-gj8w-j6xh (mcp): Unbounded session retention in StreamableHTTPTransport
4+
allows memory exhaustion via initialize flood'
5+
comments: false
6+
categories:
7+
- mcp
8+
advisory:
9+
gem: mcp
10+
ghsa: 52jp-gj8w-j6xh
11+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
12+
title: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion
13+
via initialize flood
14+
date: 2026-07-07
15+
description: |-
16+
## Summary
17+
18+
In its default configuration, MCP::Server::Transports::StreamableHTTPTransport
19+
never expires sessions. Every successful initialize request stores a
20+
new ServerSession and a session record under a fresh UUID, and the
21+
only path that removes them is an explicit client-issued HTTP DELETE.
22+
An unauthenticated attacker can repeatedly initialize new sessions
23+
and immediately disconnect, forcing the server to retain an unbounded
24+
number of ServerSession objects until memory is exhausted.
25+
cvss_v3: 5.3
26+
patched_versions:
27+
- ">= 0.23.0"
28+
related:
29+
url:
30+
- https://rubygems.org/gems/mcp/versions/0.23.0
31+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
32+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
33+
notes: |
34+
- cvss_v3 came from GHSA.
35+
- date from gem release
36+
---

‎advisories/_posts/2026-07-07-GHSA-5p9g-j988-pcwv.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-5p9g-j988-pcwv (mcp): Ruby SSE Session Poisoning'
4+
comments: false
5+
categories:
6+
- mcp
7+
advisory:
8+
gem: mcp
9+
ghsa: 5p9g-j988-pcwv
10+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv
11+
title: Ruby SSE Session Poisoning
12+
date: 2026-07-07
13+
description: |-
14+
## Summary
15+
16+
Vulnerability: Missing Session Ownership Validation in the Ruby MCP
17+
SDK's Streamable and SSE HTTP transport implementation. Any attacker
18+
with a stolen session ID can execute tools with the victim's session.
19+
This is a silent attack - the victim's session is compromised and
20+
being used for unauthorized actions, but it is hard to know for the victim.
21+
patched_versions:
22+
- ">= 0.23.0"
23+
related:
24+
url:
25+
- https://rubygems.org/gems/mcp/versions/0.23.0
26+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
27+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv
28+
notes: |
29+
- Project GHSA has high severity.
30+
- date from gem release
31+
---

‎advisories/_posts/2026-07-07-GHSA-7683-3w9x-ch42.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-7683-3w9x-ch42 (mcp): Unbounded line buffer in stdio transports leads
4+
to memory exhaustion (DoS)'
5+
comments: false
6+
categories:
7+
- mcp
8+
advisory:
9+
gem: mcp
10+
ghsa: 7683-3w9x-ch42
11+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42
12+
title: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
13+
date: 2026-07-07
14+
description: |-
15+
## Summary
16+
17+
The stdio transports in MCP::Server::Transports::StdioTransport and
18+
MCP::Client::Stdio read newline-delimited JSON-RPC frames using
19+
IO#gets with no limit argument. CRuby's IO#gets with no limit reads
20+
from the current position until the next separator (\n) with no upper
21+
bound on the returned string length. A peer that streams bytes without
22+
ever emitting a newline causes gets to accumulate the entire stream
23+
in a single Ruby String until the process is killed by the
24+
operating-system OOM killer.
25+
cvss_v3: 6.2
26+
patched_versions:
27+
- ">= 0.23.0"
28+
related:
29+
url:
30+
- https://rubygems.org/gems/mcp/versions/0.23.0
31+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
32+
- https://docs.ruby-lang.org/en/3.3/IO.html#method-i-gets
33+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42
34+
notes: |
35+
- cvss_v3 came from GHSA.
36+
- date from gem release
37+
---

‎advisories/_posts/2026-07-07-GHSA-h669-8m4g-r2hc.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-h669-8m4g-r2hc (mcp): Unbounded JSON-RPC request body causes uncontrolled
4+
memory allocation in StreamableHTTPTransport'
5+
comments: false
6+
categories:
7+
- mcp
8+
advisory:
9+
gem: mcp
10+
ghsa: h669-8m4g-r2hc
11+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc
12+
title: Unbounded JSON-RPC request body causes uncontrolled memory allocation in
13+
StreamableHTTPTransport
14+
date: 2026-07-07
15+
description: |-
16+
## Summary
17+
18+
An unauthenticated remote attacker can force any MCP Ruby SDK server
19+
using MCP::Server::Transports::StreamableHTTPTransport to allocate
20+
gigabytes of memory by sending a single oversized JSON-RPC POST. The
21+
transport reads the entire HTTP body into a Ruby String and parses
22+
it with JSON.parse(body, symbolize_names: true) with no size limit,
23+
no Content-Length pre-check, and no streaming parser, allowing
24+
trivial denial of service against the worker process.
25+
cvss_v3: 7.5
26+
patched_versions:
27+
- ">= 0.23.0"
28+
related:
29+
url:
30+
- https://rubygems.org/gems/mcp/versions/0.23.0
31+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
32+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc
33+
notes: |
34+
- cvss_v3 came from GHSA.
35+
- date from gem release
36+
---

‎advisories/_posts/2026-07-07-GHSA-rjr6-rcgv-9m7m.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-rjr6-rcgv-9m7m (mcp): Streamable HTTP transport lacks DNS-rebinding (Host/Origin)
4+
protection'
5+
comments: false
6+
categories:
7+
- mcp
8+
advisory:
9+
gem: mcp
10+
ghsa: rjr6-rcgv-9m7m
11+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m
12+
title: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
13+
date: 2026-07-07
14+
description: |-
15+
## Summary
16+
17+
MCP::Server::Transports::StreamableHTTPTransport (the Rack-mountable
18+
Streamable HTTP transport in the mcp gem) processes every incoming
19+
JSON-RPC request without ever inspecting the HTTP Host or Origin
20+
request headers. There is no AllowedHosts/AllowedOrigins allowlist
21+
and no DNS-rebinding guard anywhere in the transport. A local MCP
22+
server that binds a loopback or LAN HTTP port is therefore reachable
23+
by any web origin a victim's browser visits, via a DNS-rebinding
24+
attack: a malicious page rebinds its own hostname to 127.0.0.1, then
25+
drives the local MCP server cross-origin to enumerate and invoke
26+
its tools and exfiltrate their output. This is the standard browser-driven
27+
local-service attack that the MCP Streamable HTTP guidance exists to prevent.
28+
29+
## Impact
30+
31+
An attacker who can get a victim to open a web page can reach any MCP
32+
server the victim runs locally over the Streamable HTTP transport
33+
(e.g. a developer-tools or filesystem MCP server on localhost).
34+
Because the transport issues a session and dispatches tools/list/
35+
tools/call from a foreign Host/Origin with no rejection, the attacker
36+
can drive arbitrary server-exposed tools and read their results,
37+
exfiltrating local data (files, secrets, command output) to the
38+
attacker's origin.
39+
The blast radius is whatever the locally-running MCP server exposes.
40+
For MCP servers wired to filesystem, shell, or credential tools,
41+
this is sensitive-data disclosure and, depending on the tool set,
42+
local action execution.
43+
patched_versions:
44+
- ">= 0.23.0"
45+
related:
46+
url:
47+
- https://rubygems.org/gems/mcp/versions/0.23.0
48+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
49+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m
50+
notes: |
51+
- "Moderate" severity in GHSA but no values.
52+
- date from gem release
53+
---

0 commit comments

Comments
 (0)