CVE-2026-67430
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Jul 29, 2026
CISA due date
—
The record
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119286 GraphQL-core is a Python port of the GraphQL.js reference implementation. CWE-401
- CVE-2026-116157 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails… CWE-401
- CVE-2026-116158 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare… CWE-401
- CVE-2026-116159 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the… CWE-401
- CVE-2026-116156 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a… CWE-401
- CVE-2026-116151 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG… CWE-401
- CVE-2026-116155 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the… CWE-401
- CVE-2026-116152 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that… CWE-401