Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim Details https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamablehttptransport.rb#L260-L278 Victim starts a legitimate MCP session and receives session ID abc-123 Attacker obtains the session ID (various means - network sniffing, logs, etc. out of scope for this analysis) Attacker sends POST to /messages/abc-123 with a tool call Server accepts the request (no ownership validation!) Server executes the tool and sends response to victim's SSE stream Victim receives attacker's response, thinking it's legitimate PoC attackerclient.py legitimateclient.py Prerequisites 1. Python 3.8+ 2. Install…
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTTP body into a Ruby String and parses it with JSON.parse(body, symbolizenames: true) with no size limit, no Content-Length pre-check, and no streaming parser, allowing trivial denial of service against the worker process. Affected component lib/mcp/server/transports/streamablehttptransport.rb, method handlepost: - Line 341: bodystring = request.body.read — reads the full HTTP body into memory with no upper bound. - Lines 531–535: JSON.parse(bodystring, symbolizenames: true) — fully materialises the parsed object graph; with symbolizenames: true every JSON key also allocates a Ruby symbol. The vulnerable path runs before session validation, so it is reachable in both the default stateful mode and in stateless: true mode, without an Mcp-Session-Id…
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In its default configuration, MCP::Server::Transports::StreamableHTTPTransport never expires sessions. Every successful initialize request stores a new ServerSession and a session record under a fresh UUID, and the only path that removes them is an explicit client-issued HTTP DELETE. An unauthenticated attacker can repeatedly initialize new sessions and immediately disconnect, forcing the server to retain an unbounded number of ServerSession objects until memory is exhausted. Affected component lib/mcp/server/transports/streamablehttptransport.rb: - Line 27, constructor: def initialize(server, stateless: false, enablejsonresponse: false, sessionidletimeout: nil) — the default for sessionidletimeout is nil. - Line 46: startreaperthread if @sessionidletimeout — when the timeout is nil, the reaper that prunes idle sessions is never started. - Lines 604–643 (handleinitialization): every successful initialize inserts a new session record; the only removal sites are handledelete…
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The stdio transports in MCP::Server::Transports::StdioTransport and MCP::Client::Stdio read newline-delimited JSON-RPC frames using IO#gets with no limit argument. CRuby's IO#gets with no limit reads from the current position until the next separator (\n) with no upper bound on the returned string length. A peer that streams bytes without ever emitting a newline causes gets to accumulate the entire stream in a single Ruby String until the process is killed by the operating-system OOM killer. This is the same vulnerability class tracked in sibling MCP SDKs as GHSA-74gp-qhv5-v493 (Kotlin), GHSA-wqgc-pwpr-pq7r (TypeScript), GHSA-655q-2283-6jgj (Python), and others. It was identified during a cross-SDK audit; ruby-sdk had no prior report. Affected code Verified at main @ cf44475c. Server transport — lib/mcp/server/transports/stdiotransport.rb $stdin is the raw process global (only setencoding is applied at line 16); there is no wrapper imposing a length limit. Client transport —…
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MCP::Server::Transports::StreamableHTTPTransport (the Rack-mountable Streamable HTTP transport in the mcp gem) processes every incoming JSON-RPC request without ever inspecting the HTTP Host or Origin request headers. There is no AllowedHosts/AllowedOrigins allowlist and no DNS-rebinding guard anywhere in the transport. A local MCP server that binds a loopback or LAN HTTP port is therefore reachable by any web origin a victim's browser visits, via a DNS-rebinding attack: a malicious page rebinds its own hostname to 127.0.0.1, then drives the local MCP server cross-origin to enumerate and invoke its tools and exfiltrate their output. This is the standard browser-driven local-service attack that the MCP Streamable HTTP guidance exists to prevent. Impact - An attacker who can get a victim to open a web page can reach any MCP server the victim runs locally over the Streamable HTTP transport (e.g. a developer-tools or filesystem MCP server on localhost). - Because the transport…
Recommended action: Upgrade to 0.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Ruby SDK's streamablehttptransport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Details Root Cause The StreamableHTTPTransport implementation stores only one SSE stream object per session ID and lacks: - Session-to-user identity binding - Ownership validation when establishing SSE connections - Protection against multiple simultaneous connections to the same session PoC Vulnerable Code File: streamablehttptransport.rb - L336-L339: Attack Scenario Step 1: Legitimate Session Establishment Step 2: Session ID Compromise - An attacker obtains the session ID through various means (out of scope for this analysis) Step 3: Stream Hijacking Step 4: Data Interception - ALL subsequent tool responses/notifications go to the attacker - The legitimate user receives no data and has no indication of the hijacking Technical Details…
Recommended action: Upgrade to 0.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.