Is CVE-2026-67430 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67430 being exploited in the wild.

How severe is CVE-2026-67430?

Medium severity, with a CVSS score of 5.3, published 29 July 2026.

Which products and versions are affected?

mcp (RubyGems) ECOSYSTEM:introduced=0,fixed=0.23.0.

Is there a fix for CVE-2026-67430?

Yes. mcp (RubyGems): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67430 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67430?

Check whether you run Model Context Protocol Ruby SDK or mcp (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67430: Model Context Protocol Ruby SDK memory exhaustion in StreamableHTTPTransport

CVE-2026-67430 · Severity: medium · CVSS 5.3 · Published 2026-07-29

The Model Context Protocol (MCP) Ruby SDK, which provides a standard for connecting AI models to data sources, contains a flaw in how it handles network sessions. By default, the server does not automatically close or expire old sessions, allowing an attacker to flood the system with connection requests that never time out. This can lead to the server running out of memory and crashing, resulting in a total service outage for all users.

Technologies: mcp (RubyGems). Vendors: Model Context Protocol, RubyGems.

Quick answers

Is CVE-2026-67430 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67430 being exploited in the wild.
How severe is CVE-2026-67430?: Medium severity, with a CVSS score of 5.3, published 29 July 2026.
Which products and versions are affected?: mcp (RubyGems) ECOSYSTEM:introduced=0,fixed=0.23.0.
Is there a fix for CVE-2026-67430?: Yes. mcp (RubyGems): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67430 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67430?: Check whether you run Model Context Protocol Ruby SDK or mcp (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mcp (RubyGems): upgrade to 0.23.0 or later
```
bundle update mcp
```

Technical details

A denial of service vulnerability exists in the `MCP::Server::Transports::StreamableHTTPTransport` component of the MCP Ruby SDK. The `session_idle_timeout` parameter defaults to `nil`, which prevents the session reaper thread from starting and results in unbounded session retention. An unauthenticated remote attacker can repeatedly send `initialize` requests to create new `ServerSession` objects; since these sessions are only removed via explicit `DELETE` requests or stream errors, the server's memory (RSS) will grow linearly until the process is terminated by the operating system (OOM-killed). This issue is addressed in version 0.23.0 by introducing finite session timeouts.

Affected products

Model Context Protocol (MCP) Ruby SDK mcp <= 0.22.0

Identifiers

CVE-2026-67430
GHSA-52jp-gj8w-j6xh

Timeline

2026-07-29: advisory: NVD publication date
2026-07-30: disclosed: GitHub Advisory published
2026-07-30: patched: Version 0.23.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.