Executive brief
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
Affected products
- RubyGems mcp
Junglewise Threat Intelligence
CVE-2026-33946: MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
CVE-2026-33946 · Severity: medium · CVSS 4 · Published 2026-03-27
Vendors: RubyGems.
Related threats
- Model Context Protocol Ruby SDK memory exhaustion in StreamableHTTPTransport
- modelcontextprotocol ruby-sdk session hijacking in StreamableHTTPTransport
- Model Context Protocol Ruby SDK memory exhaustion in StreamableHTTPTransport
- modelcontextprotocol ruby-sdk memory exhaustion in Stdio transports
- modelcontextprotocol ruby-sdk DNS rebinding in StreamableHTTPTransport