What is CVE-2026-67430?

CVE-2026-67430 is a medium-severity vulnerability in Modelcontextprotocol Ruby-Sdk, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.3/10. Published 2026-07-29.

How severe is CVE-2026-67430?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Resource exhaustion in Modelcontextprotocol Ruby-Sdk

CVE-2026-67430

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

EPSS: 0.003 (23.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Modelcontextprotocol Ruby-sdk — versions < 0.23.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-67430?: CVE-2026-67430 is a medium-severity vulnerability in Modelcontextprotocol Ruby-Sdk, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.3/10. Published 2026-07-29.
How severe is CVE-2026-67430?: Medium severity. CVSS v3 base score is 5.3 out of 10.