CVE-2026-63119

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This issue is fixed in version 0.23.0.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/modelcontextprotocol/ruby-sdk/commit/267b8fa6285453525c81ce43db6b7dcd7a8a8c2f
https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42
https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) MCP Ruby SDK es el SDK oficial de Ruby para servidores y clientes del Protocolo de Contexto de Modelo. Antes de la 0.23.0, MCP::Server::Transports::StdioTransport y MCP::Client::Stdio en la gema mcp usan IO#gets sin un límite de bytes, permitiendo que un par que envía datos sin un salto de línea agote la memoria del proceso. Este problema está solucionado en la versión 0.23.0.

Information

Published : 2026-07-29 20:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-63119

Mitre link : CVE-2026-63119

CVE.ORG link : CVE-2026-63119

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-63119", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63119", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T19:28:33.562204Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "modelcontextprotocol", "product": "ruby-sdk", "versions": [{"status": "affected", "version": "< 0.23.0"}]}]}], "published": "2026-07-29T20:17:10.790", "references": [{"url": "https://github.com/modelcontextprotocol/ruby-sdk/commit/267b8fa6285453525c81ce43db6b7dcd7a8a8c2f", "source": "security-advisories@github.com"}, {"url": "https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42", "source": "security-advisories@github.com"}, {"url": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This issue is fixed in version 0.23.0."}, {"lang": "es", "value": "MCP Ruby SDK es el SDK oficial de Ruby para servidores y clientes del Protocolo de Contexto de Modelo. Antes de la 0.23.0, MCP::Server::Transports::StdioTransport y MCP::Client::Stdio en la gema mcp usan IO#gets sin un l\u00edmite de bytes, permitiendo que un par que env\u00eda datos sin un salto de l\u00ednea agote la memoria del proceso. Este problema est\u00e1 solucionado en la versi\u00f3n 0.23.0."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "security-advisories@github.com"}