Skip to content

Commit 817e2c4

Browse files
jasnowjasnow
authored
Five new mcp gem advisories (#1169)
1 parent 32a64d0 commit 817e2c4

5 files changed

Lines changed: 155 additions & 0 deletions

File tree

‎gems/mcp/GHSA-52jp-gj8w-j6xh.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
gem: mcp
3+
ghsa: 52jp-gj8w-j6xh
4+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
5+
title: Unbounded session retention in StreamableHTTPTransport allows
6+
memory exhaustion via initialize flood
7+
date: 2026-07-07
8+
description: |
9+
## Summary
10+
11+
In its default configuration, MCP::Server::Transports::StreamableHTTPTransport
12+
never expires sessions. Every successful initialize request stores a
13+
new ServerSession and a session record under a fresh UUID, and the
14+
only path that removes them is an explicit client-issued HTTP DELETE.
15+
An unauthenticated attacker can repeatedly initialize new sessions
16+
and immediately disconnect, forcing the server to retain an unbounded
17+
number of ServerSession objects until memory is exhausted.
18+
cvss_v3: 5.3
19+
patched_versions:
20+
- ">= 0.23.0"
21+
related:
22+
url:
23+
- https://rubygems.org/gems/mcp/versions/0.23.0
24+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
25+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
26+
notes: |
27+
- cvss_v3 came from GHSA.
28+
- date from gem release

‎gems/mcp/GHSA-5p9g-j988-pcwv.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
gem: mcp
3+
ghsa: 5p9g-j988-pcwv
4+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv
5+
title: Ruby SSE Session Poisoning
6+
date: 2026-07-07
7+
description: |
8+
## Summary
9+
10+
Vulnerability: Missing Session Ownership Validation in the Ruby MCP
11+
SDK's Streamable and SSE HTTP transport implementation. Any attacker
12+
with a stolen session ID can execute tools with the victim's session.
13+
This is a silent attack - the victim's session is compromised and
14+
being used for unauthorized actions, but it is hard to know for the victim.
15+
patched_versions:
16+
- ">= 0.23.0"
17+
related:
18+
url:
19+
- https://rubygems.org/gems/mcp/versions/0.23.0
20+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
21+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv
22+
notes: |
23+
- Project GHSA has high severity.
24+
- date from gem release

‎gems/mcp/GHSA-7683-3w9x-ch42.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
gem: mcp
3+
ghsa: 7683-3w9x-ch42
4+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42
5+
title: Unbounded line buffer in stdio transports leads to memory
6+
exhaustion (DoS)
7+
date: 2026-07-07
8+
description: |
9+
## Summary
10+
11+
The stdio transports in MCP::Server::Transports::StdioTransport and
12+
MCP::Client::Stdio read newline-delimited JSON-RPC frames using
13+
IO#gets with no limit argument. CRuby's IO#gets with no limit reads
14+
from the current position until the next separator (\n) with no upper
15+
bound on the returned string length. A peer that streams bytes without
16+
ever emitting a newline causes gets to accumulate the entire stream
17+
in a single Ruby String until the process is killed by the
18+
operating-system OOM killer.
19+
cvss_v3: 6.2
20+
patched_versions:
21+
- ">= 0.23.0"
22+
related:
23+
url:
24+
- https://rubygems.org/gems/mcp/versions/0.23.0
25+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
26+
- https://docs.ruby-lang.org/en/3.3/IO.html#method-i-gets
27+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42
28+
notes: |
29+
- cvss_v3 came from GHSA.
30+
- date from gem release

‎gems/mcp/GHSA-h669-8m4g-r2hc.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
gem: mcp
3+
ghsa: h669-8m4g-r2hc
4+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc
5+
title: Unbounded JSON-RPC request body causes uncontrolled memory
6+
allocation in StreamableHTTPTransport
7+
date: 2026-07-07
8+
description: |
9+
## Summary
10+
11+
An unauthenticated remote attacker can force any MCP Ruby SDK server
12+
using MCP::Server::Transports::StreamableHTTPTransport to allocate
13+
gigabytes of memory by sending a single oversized JSON-RPC POST. The
14+
transport reads the entire HTTP body into a Ruby String and parses
15+
it with JSON.parse(body, symbolize_names: true) with no size limit,
16+
no Content-Length pre-check, and no streaming parser, allowing
17+
trivial denial of service against the worker process.
18+
cvss_v3: 7.5
19+
patched_versions:
20+
- ">= 0.23.0"
21+
related:
22+
url:
23+
- https://rubygems.org/gems/mcp/versions/0.23.0
24+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
25+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc
26+
notes: |
27+
- cvss_v3 came from GHSA.
28+
- date from gem release

‎gems/mcp/GHSA-rjr6-rcgv-9m7m.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
gem: mcp
3+
ghsa: rjr6-rcgv-9m7m
4+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m
5+
title: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
6+
date: 2026-07-07
7+
description: |
8+
## Summary
9+
10+
MCP::Server::Transports::StreamableHTTPTransport (the Rack-mountable
11+
Streamable HTTP transport in the mcp gem) processes every incoming
12+
JSON-RPC request without ever inspecting the HTTP Host or Origin
13+
request headers. There is no AllowedHosts/AllowedOrigins allowlist
14+
and no DNS-rebinding guard anywhere in the transport. A local MCP
15+
server that binds a loopback or LAN HTTP port is therefore reachable
16+
by any web origin a victim's browser visits, via a DNS-rebinding
17+
attack: a malicious page rebinds its own hostname to 127.0.0.1, then
18+
drives the local MCP server cross-origin to enumerate and invoke
19+
its tools and exfiltrate their output. This is the standard browser-driven
20+
local-service attack that the MCP Streamable HTTP guidance exists to prevent.
21+
22+
## Impact
23+
24+
An attacker who can get a victim to open a web page can reach any MCP
25+
server the victim runs locally over the Streamable HTTP transport
26+
(e.g. a developer-tools or filesystem MCP server on localhost).
27+
Because the transport issues a session and dispatches tools/list/
28+
tools/call from a foreign Host/Origin with no rejection, the attacker
29+
can drive arbitrary server-exposed tools and read their results,
30+
exfiltrating local data (files, secrets, command output) to the
31+
attacker's origin.
32+
The blast radius is whatever the locally-running MCP server exposes.
33+
For MCP servers wired to filesystem, shell, or credential tools,
34+
this is sensitive-data disclosure and, depending on the tool set,
35+
local action execution.
36+
patched_versions:
37+
- ">= 0.23.0"
38+
related:
39+
url:
40+
- https://rubygems.org/gems/mcp/versions/0.23.0
41+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
42+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m
43+
notes: |
44+
- "Moderate" severity in GHSA but no values.
45+
- date from gem release

0 commit comments

Comments
 (0)