MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the m…

CVE-2026-67432 affects the MCP Ruby SDK (mcp gem) prior to version 0.23.0. The vulnerability resides in MCP::Server::Transports::StreamableHTTPTransport, which reads and parses entire JSON-RPC POST request bodies without enforcing any size limit. This allows an unauthenticated remote attacker to send arbitrarily large payloads, exhausting the server process memory and causing a denial of service. The issue is classified as a resource exhaustion vulnerability with no authentication required for exploitation. The fix was introduced in version 0.23.0 of the mcp gem. Affected users should upgrade immediately to mitigate the risk. The vulnerability was disclosed via GitHub Security Advisories and the NVD.