https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T15:14:56.321383+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-342521 EUVD-2026-342521 2026-10-08T15:14:56.369253+00:00 EUVD-2026-342521 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63119 fkie_cve-2026-63119 2026-10-08T15:14:56.369292+00:00

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This issue is fixed in version 0.23.0.

 https://cve.radiocsirt.org/vuln/ghsa-7683-3w9x-ch42 GHSA-7683-3w9x-ch42 — MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) 2026-10-08T15:14:56.369327+00:00

Affected: RubyGems: mcp

## Summary

The stdio transports in `MCP::Server::Transports::StdioTransport` and `MCP::Client::Stdio` read newline-delimited JSON-RPC frames using `IO#gets` with no `limit` argument. CRuby's `IO#gets` with no limit reads from the current position until the next separator (`\n`) with no upper bound on the returned string length. A peer that streams bytes without ever emitting a newline causes `gets` to accumulate the entire stream in a single Ruby `String` until the process is killed by the operating-system OOM killer.

This is the same vulnerability class tracked in sibling MCP SDKs as GHSA-74gp-qhv5-v493 (Kotlin), GHSA-wqgc-pwpr-pq7r (TypeScript), GHSA-655q-2283-6jgj (Python), and others. It was identified during a cross-SDK audit; ruby-sdk had no prior report.

## Affected code

Verified at `main` @ `cf44475c`.

### Server transport — [`lib/mcp/server/transports/stdio_transport.rb`](https://github.com/modelcontextprotocol/ruby-sdk/blob/cf44475c/lib/mcp/server/transports/stdio_transport.rb)

```ruby # line 23 while @open && (line = $stdin.gets) # <-- no limit argument response = @session.handle_json(line.strip) ...

# line 76 while @open && (line = $stdin.gets) # <-- no limit argument begin parsed = JSON.parse(line.strip, symbolize_names: true) ```

`$stdin` is the raw process global (only `set_encoding` is applied at line 16); there is no wrapper imposing a length limit.

### Client transport — [`lib/mcp/client/stdio.rb`](https://github.com/modelco…