CVE-2026-67432 affects the MCP Ruby SDK (mcp gem) prior to version 0.23.0. The vulnerability resides in MCP::Server::Transports::StreamableHTTPTransport, which reads and parses entire JSON-RPC POST request bodies without enforcing any size limit. This allows an unauthenticated remote attacker to send arbitrarily large payloads, exhausting the server process memory and causing a denial of service. The issue is classified as a resource exhaustion vulnerability with no authentication required for exploitation. The fix was introduced in version 0.23.0 of the mcp gem. Affected users should upgrade immediately to mitigate the risk. The vulnerability was disclosed via GitHub Security Advisories and the NVD.