Executive brief
The Model Context Protocol (MCP) Ruby SDK is a library used to build servers that connect AI models with local tools and data. A vulnerability in how the server handles incoming web requests allows an unauthenticated attacker to crash the server by sending a single, specially crafted large message. This results in a denial of service, making the AI tools and integrated services unavailable to legitimate users.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the `StreamableHTTPTransport` and `StdioTransport` components of the MCP Ruby SDK. The `handle_post` method in the HTTP transport reads the entire request body into memory using `request.body.read` without enforcing a size limit or checking the `Content-Length` header. Subsequently, `JSON.parse` is called on the unbounded string, leading to massive memory allocation and potential Out-Of-Memory (OOM) termination of the worker process. This occurs before any session validation or authentication, allowing unauthenticated network-based exploitation. The issue is addressed in version 0.23.0 by implementing request size limits.
Affected products
- Model Context Protocol (MCP) mcp <= 0.22.0
Timeline
- 2026-07-08: disclosed
- 2026-07-29: advisory: NVD publication date
- 2026-07-30: patched: GitHub Advisory published and version 0.23.0 released