From d13893910661d33ffc40c5ebb7f068d5ca9621a7 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sat, 1 Aug 2026 14:29:33 -0400 Subject: [PATCH 1/2] GHSA/SYNC + updated 5 mcp gem advisories --- ...-rjr6-rcgv-9m7m.yml => CVE-2026-63118.yml} | 19 ++++++- ...-7683-3w9x-ch42.yml => CVE-2026-63119.yml} | 17 ++++++- gems/mcp/CVE-2026-67430.yml | 49 +++++++++++++++++++ ...-5p9g-j988-pcwv.yml => CVE-2026-67431.yml} | 21 ++++++-- gems/mcp/CVE-2026-67432.yml | 49 +++++++++++++++++++ gems/mcp/GHSA-52jp-gj8w-j6xh.yml | 28 ----------- gems/mcp/GHSA-h669-8m4g-r2hc.yml | 28 ----------- 7 files changed, 148 insertions(+), 63 deletions(-) rename gems/mcp/{GHSA-rjr6-rcgv-9m7m.yml => CVE-2026-63118.yml} (72%) rename gems/mcp/{GHSA-7683-3w9x-ch42.yml => CVE-2026-63119.yml} (66%) create mode 100644 gems/mcp/CVE-2026-67430.yml rename gems/mcp/{GHSA-5p9g-j988-pcwv.yml => CVE-2026-67431.yml} (51%) create mode 100644 gems/mcp/CVE-2026-67432.yml delete mode 100644 gems/mcp/GHSA-52jp-gj8w-j6xh.yml delete mode 100644 gems/mcp/GHSA-h669-8m4g-r2hc.yml diff --git a/gems/mcp/GHSA-rjr6-rcgv-9m7m.yml b/gems/mcp/CVE-2026-63118.yml similarity index 72% rename from gems/mcp/GHSA-rjr6-rcgv-9m7m.yml rename to gems/mcp/CVE-2026-63118.yml index aaf8b489d8..22cf392175 100644 --- a/gems/mcp/GHSA-rjr6-rcgv-9m7m.yml +++ b/gems/mcp/CVE-2026-63118.yml @@ -1,7 +1,8 @@ --- gem: mcp +cve: 2026-63118 ghsa: rjr6-rcgv-9m7m -url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m +url: https://nvd.nist.gov/vuln/detail/CVE-2026-63118 title: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection date: 2026-07-07 description: | @@ -33,13 +34,27 @@ description: | For MCP servers wired to filesystem, shell, or credential tools, this is sensitive-data disclosure and, depending on the tool set, local action execution. + + ## Credit + + Reported by tonghuaroot. +cvss_v4: 6.9 patched_versions: - ">= 0.23.0" related: url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-63118 - https://rubygems.org/gems/mcp/versions/0.23.0 - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 + - https://github.com/modelcontextprotocol/ruby-sdk/commit/ba543083a7594e7892b29464b89091816446ff7a + - https://advisories.gitlab.com/gem/mcp/CVE-2026-63118 + - https://osv.dev/vulnerability/GHSA-rjr6-rcgv-9m7m - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m + - https://github.com/advisories/GHSA-rjr6-rcgv-9m7m notes: | - - "Moderate" severity in GHSA but no values. - date from gem release + - cvss_v4 from GHSA and nvd.nist.gov URL + - From GHSA: "Reporter notes: This issue was found by source review of + the `mcp` gem's Streamable HTTP transport and confirmed end-to-end + against the released gem `mcp` 0.18.0 as shown above. It is + reported independently on its own merits." diff --git a/gems/mcp/GHSA-7683-3w9x-ch42.yml b/gems/mcp/CVE-2026-63119.yml similarity index 66% rename from gems/mcp/GHSA-7683-3w9x-ch42.yml rename to gems/mcp/CVE-2026-63119.yml index 03bf8d5c00..8629dae5b5 100644 --- a/gems/mcp/GHSA-7683-3w9x-ch42.yml +++ b/gems/mcp/CVE-2026-63119.yml @@ -1,7 +1,8 @@ --- gem: mcp +cve: 2026-63119 ghsa: 7683-3w9x-ch42 -url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42 +url: https://nvd.nist.gov/vuln/detail/CVE-2026-63119 title: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) date: 2026-07-07 @@ -16,15 +17,27 @@ description: | ever emitting a newline causes gets to accumulate the entire stream in a single Ruby String until the process is killed by the operating-system OOM killer. + + ## Credit + + Reported by tonghuaroot + + Identified during a cross-SDK audit of the stdio unbounded-buffer + vulnerability class, prompted by GHSA-74gp-qhv5-v493. cvss_v3: 6.2 patched_versions: - ">= 0.23.0" related: url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-63119 + - https://rubygems.org/gems/mcp/versions/0.23.0 - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 - https://docs.ruby-lang.org/en/3.3/IO.html#method-i-gets + - https://github.com/modelcontextprotocol/ruby-sdk/commit/267b8fa6285453525c81ce43db6b7dcd7a8a8c2f + - https://advisories.gitlab.com/gem/mcp/CVE-2026-63119 + - https://osv.dev/vulnerability/GHSA-7683-3w9x-ch42 - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42 notes: | - - cvss_v3 came from GHSA. + - cvss_v3 from GHSA - date from gem release diff --git a/gems/mcp/CVE-2026-67430.yml b/gems/mcp/CVE-2026-67430.yml new file mode 100644 index 0000000000..200ef8864d --- /dev/null +++ b/gems/mcp/CVE-2026-67430.yml @@ -0,0 +1,49 @@ +--- +gem: mcp +cve: 2026-67430 +ghsa: 52jp-gj8w-j6xh +url: https://nvd.nist.gov/vuln/detail/CVE-2026-67430 +title: Unbounded session retention in StreamableHTTPTransport allows + memory exhaustion via initialize flood +date: 2026-07-07 +description: | + ## Summary + + In its default configuration, MCP::Server::Transports::StreamableHTTPTransport + never expires sessions. Every successful initialize request stores a + new ServerSession and a session record under a fresh UUID, and the + only path that removes them is an explicit client-issued HTTP DELETE. + An unauthenticated attacker can repeatedly initialize new sessions + and immediately disconnect, forcing the server to retain an unbounded + number of ServerSession objects until memory is exhausted. + + ## Impact + + - **Attacker requirements:** unauthenticated TCP reach of the MCP + endpoint. No session, no credentials. + + - **Effect:** memory-exhaustion denial of service. A sustained or + distributed attacker can OOM the worker; on services that recycle + workers, the attacker simply repeats. On multi-tenant gateways, one + tenant can starve all others. + + - **Affected deployments:** every deployment that does not opt into + `session_idle_timeout`. Because the README presents this as an + opt-in mitigation rather than a default, real-world deployments + are likely to ship vulnerable. +cvss_v3: 5.3 +patched_versions: + - ">= 0.23.0" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-67430 + - https://rubygems.org/gems/mcp/versions/0.23.0 + - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 + - https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4 + - https://advisories.gitlab.com/gem/mcp/CVE-2026-67431 + - https://osv.dev/vulnerability/GHSA-52jp-gj8w-j6xh + - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh + - https://github.com/advisories/GHSA-52jp-gj8w-j6xh +notes: | + - cvss_v3 from GHSA + - date from gem release diff --git a/gems/mcp/GHSA-5p9g-j988-pcwv.yml b/gems/mcp/CVE-2026-67431.yml similarity index 51% rename from gems/mcp/GHSA-5p9g-j988-pcwv.yml rename to gems/mcp/CVE-2026-67431.yml index a18ccb26fe..58ebdeea78 100644 --- a/gems/mcp/GHSA-5p9g-j988-pcwv.yml +++ b/gems/mcp/CVE-2026-67431.yml @@ -1,8 +1,9 @@ --- gem: mcp +cve: 2026-67431 ghsa: 5p9g-j988-pcwv -url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv -title: Ruby SSE Session Poisoning +url: https://nvd.nist.gov/vuln/detail/CVE-2026-67431 +title: MCP Ruby SDK - Ruby SSE Session Poisoning date: 2026-07-07 description: | ## Summary @@ -12,13 +13,27 @@ description: | with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim. + + ## Impact + + - **Integrity:** HIGH - Attacker can execute unauthorized tools and + modify state. + + - **Availability:** LOW - Attacker can disrupt victim's session with + injected responses. +cvss_v4: 8.3 patched_versions: - ">= 0.23.0" related: url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-67431 - https://rubygems.org/gems/mcp/versions/0.23.0 - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 + - https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356 + - https://advisories.gitlab.com/gem/mcp/CVE-2026-67431 + - https://osv.dev/vulnerability/GHSA-5p9g-j988-pcwv - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv + - https://github.com/advisories/GHSA-5p9g-j988-pcwv notes: | - - Project GHSA has high severity. + - cvss_v4 from GHSA; Project GHSA has high severity. - date from gem release diff --git a/gems/mcp/CVE-2026-67432.yml b/gems/mcp/CVE-2026-67432.yml new file mode 100644 index 0000000000..19df5bbac5 --- /dev/null +++ b/gems/mcp/CVE-2026-67432.yml @@ -0,0 +1,49 @@ +--- +gem: mcp +cve: 2026-67432 +ghsa: h669-8m4g-r2hc +url: https://nvd.nist.gov/vuln/detail/CVE-2026-67432 +title: Unbounded JSON-RPC request body causes uncontrolled memory + allocation in StreamableHTTPTransport +date: 2026-07-07 +description: | + ## Summary + + An unauthenticated remote attacker can force any MCP Ruby SDK server + using MCP::Server::Transports::StreamableHTTPTransport to allocate + gigabytes of memory by sending a single oversized JSON-RPC POST. The + transport reads the entire HTTP body into a Ruby String and parses + it with JSON.parse(body, symbolize_names: true) with no size limit, + no Content-Length pre-check, and no streaming parser, allowing + trivial denial of service against the worker process. + + ## Impact + + - **Attacker requirements:** none beyond TCP reach of the MCP + endpoint. No session, no credentials, no prior interaction. + + - **Effect:** memory-exhaustion denial of service. A single request + can take a worker offline; sustained low-rate requests keep the + service down across worker restarts. On multi-tenant deployments a + single attacker tenant can starve neighbours. + + - **Affected deployments:** every server mounting + `MCP::Server::Transports::StreamableHTTPTransport` as a Rack + app — the canonical HTTP deployment pattern. Both stateful + and `stateless: true` configurations are affected. +cvss_v3: 7.5 +patched_versions: + - ">= 0.23.0" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-67432 + - https://rubygems.org/gems/mcp/versions/0.23.0 + - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 + - https://github.com/modelcontextprotocol/ruby-sdk/commit/772e0cb1f9db69312006926eee59a7287ad50166 + - https://advisories.gitlab.com/gem/mcp/CVE-2026-67432 + - https://osv.dev/vulnerability/GHSA-h669-8m4g-r2hc + - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc + - https://github.com/advisories/GHSA-h669-8m4g-r2hc +notes: | + - cvss_v3 from GHSA + - date from gem release diff --git a/gems/mcp/GHSA-52jp-gj8w-j6xh.yml b/gems/mcp/GHSA-52jp-gj8w-j6xh.yml deleted file mode 100644 index d1c9826dd1..0000000000 --- a/gems/mcp/GHSA-52jp-gj8w-j6xh.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -gem: mcp -ghsa: 52jp-gj8w-j6xh -url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh -title: Unbounded session retention in StreamableHTTPTransport allows - memory exhaustion via initialize flood -date: 2026-07-07 -description: | - ## Summary - - In its default configuration, MCP::Server::Transports::StreamableHTTPTransport - never expires sessions. Every successful initialize request stores a - new ServerSession and a session record under a fresh UUID, and the - only path that removes them is an explicit client-issued HTTP DELETE. - An unauthenticated attacker can repeatedly initialize new sessions - and immediately disconnect, forcing the server to retain an unbounded - number of ServerSession objects until memory is exhausted. -cvss_v3: 5.3 -patched_versions: - - ">= 0.23.0" -related: - url: - - https://rubygems.org/gems/mcp/versions/0.23.0 - - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 - - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh -notes: | - - cvss_v3 came from GHSA. - - date from gem release diff --git a/gems/mcp/GHSA-h669-8m4g-r2hc.yml b/gems/mcp/GHSA-h669-8m4g-r2hc.yml deleted file mode 100644 index 7ac55ad826..0000000000 --- a/gems/mcp/GHSA-h669-8m4g-r2hc.yml +++ /dev/null @@ -1,28 +0,0 @@ ---- -gem: mcp -ghsa: h669-8m4g-r2hc -url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc -title: Unbounded JSON-RPC request body causes uncontrolled memory - allocation in StreamableHTTPTransport -date: 2026-07-07 -description: | - ## Summary - - An unauthenticated remote attacker can force any MCP Ruby SDK server - using MCP::Server::Transports::StreamableHTTPTransport to allocate - gigabytes of memory by sending a single oversized JSON-RPC POST. The - transport reads the entire HTTP body into a Ruby String and parses - it with JSON.parse(body, symbolize_names: true) with no size limit, - no Content-Length pre-check, and no streaming parser, allowing - trivial denial of service against the worker process. -cvss_v3: 7.5 -patched_versions: - - ">= 0.23.0" -related: - url: - - https://rubygems.org/gems/mcp/versions/0.23.0 - - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 - - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc -notes: | - - cvss_v3 came from GHSA. - - date from gem release From 4b408f62f7c884a0cd8c4c6c82248fc681604d4d Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 2 Aug 2026 09:06:17 -0400 Subject: [PATCH 2/2] Fix advisory link for CVE-2026-67430 --- gems/mcp/CVE-2026-67430.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/mcp/CVE-2026-67430.yml b/gems/mcp/CVE-2026-67430.yml index 200ef8864d..1ac137683e 100644 --- a/gems/mcp/CVE-2026-67430.yml +++ b/gems/mcp/CVE-2026-67430.yml @@ -40,7 +40,7 @@ related: - https://rubygems.org/gems/mcp/versions/0.23.0 - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 - https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4 - - https://advisories.gitlab.com/gem/mcp/CVE-2026-67431 + - https://advisories.gitlab.com/gem/mcp/CVE-2026-67430 - https://osv.dev/vulnerability/GHSA-52jp-gj8w-j6xh - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh - https://github.com/advisories/GHSA-52jp-gj8w-j6xh