Executive brief
The Model Context Protocol (MCP) Ruby SDK, which provides a standard for connecting AI models to data sources, contains a flaw in how it handles network sessions. By default, the server does not automatically close or expire old sessions, allowing an attacker to flood the system with connection requests that never time out. This can lead to the server running out of memory and crashing, resulting in a total service outage for all users.
Technical details
A denial of service vulnerability exists in the `MCP::Server::Transports::StreamableHTTPTransport` component of the MCP Ruby SDK. The `session_idle_timeout` parameter defaults to `nil`, which prevents the session reaper thread from starting and results in unbounded session retention. An unauthenticated remote attacker can repeatedly send `initialize` requests to create new `ServerSession` objects; since these sessions are only removed via explicit `DELETE` requests or stream errors, the server's memory (RSS) will grow linearly until the process is terminated by the operating system (OOM-killed). This issue is addressed in version 0.23.0 by introducing finite session timeouts.
Affected products
- Model Context Protocol (MCP) Ruby SDK mcp <= 0.22.0
Timeline
- 2026-07-29: advisory: NVD publication date
- 2026-07-30: disclosed: GitHub Advisory published
- 2026-07-30: patched: Version 0.23.0 released