mcp
RubyGems6 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting mcppage 1 of 1
- CVE-2026-33946MEDIUMCVSS 5.9EG 5.9✓ Fixed in 0.9.22026-03-27
vulnerable: 0.1.0 ... 0.9.1 (11 versions)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a …
- CVE-2026-63118MEDIUMCVSS 6.9EG 6.9✓ Fixed in 0.23.02026-07-29
vulnerable: 0.1.0 ... 0.9.2 (25 versions)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows …
- CVE-2026-63119MEDIUMCVSS 6.2EG 6.2✓ Fixed in 0.23.02026-07-29
vulnerable: 0.1.0 ... 0.9.2 (25 versions)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer that sen…
- CVE-2026-67430MEDIUMCVSS 5.3EG 5.3✓ Fixed in 0.23.02026-07-29
vulnerable: 0.1.0 ... 0.9.2 (25 versions)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests ret…
- CVE-2026-67431HIGHCVSS 8.3EG 8.3✓ Fixed in 0.23.02026-07-29
vulnerable: 0.1.0 ... 0.9.2 (25 versions)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with…
- CVE-2026-67432HIGHCVSS 7.5EG 7.5✓ Fixed in 0.23.02026-07-29
vulnerable: 0.1.0 ... 0.9.2 (25 versions)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allo…
Check whether mcp is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for mcp CVEs against the assets you own.
Start Free Scan →