GHSA/SYNC + updated 5 mcp gem advisories

gems/mcp/GHSA-rjr6-rcgv-9m7m.yml → gems/mcp/CVE-2026-63118.yml

@@ -1,7 +1,8 @@
 ---
 gem: mcp
+cve: 2026-63118
 ghsa: rjr6-rcgv-9m7m
-url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-63118
 title: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
 date: 2026-07-07
 description: |
@@ -33,13 +34,27 @@ description: |
   For MCP servers wired to filesystem, shell, or credential tools,
   this is sensitive-data disclosure and, depending on the tool set,
   local action execution.
+
+  ## Credit
+
+  Reported by tonghuaroot.
+cvss_v4: 6.9
 patched_versions:
   - ">= 0.23.0"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-63118
     - https://rubygems.org/gems/mcp/versions/0.23.0
     - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
+    - https://github.com/modelcontextprotocol/ruby-sdk/commit/ba543083a7594e7892b29464b89091816446ff7a
+    - https://advisories.gitlab.com/gem/mcp/CVE-2026-63118
+    - https://osv.dev/vulnerability/GHSA-rjr6-rcgv-9m7m
     - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m
+    - https://github.com/advisories/GHSA-rjr6-rcgv-9m7m
 notes: |
-  - "Moderate" severity in GHSA but no values.
   - date from gem release
+  - cvss_v4 from GHSA and nvd.nist.gov URL
+  - From GHSA: "Reporter notes: This issue was found by source review of
+    the `mcp` gem's Streamable HTTP transport and confirmed end-to-end
+    against the released gem `mcp` 0.18.0 as shown above. It is
+    reported independently on its own merits."

gems/mcp/GHSA-7683-3w9x-ch42.yml → gems/mcp/CVE-2026-63119.yml

@@ -1,7 +1,8 @@
 ---
 gem: mcp
+cve: 2026-63119
 ghsa: 7683-3w9x-ch42
-url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-63119
 title: Unbounded line buffer in stdio transports leads to memory
   exhaustion (DoS)
 date: 2026-07-07
@@ -16,15 +17,27 @@ description: |
   ever emitting a newline causes gets to accumulate the entire stream
   in a single Ruby String until the process is killed by the
   operating-system OOM killer.
+
+  ## Credit
+
+  Reported by tonghuaroot
+
+  Identified during a cross-SDK audit of the stdio unbounded-buffer
+  vulnerability class, prompted by GHSA-74gp-qhv5-v493.
 cvss_v3: 6.2
 patched_versions:
   - ">= 0.23.0"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-63119
+
     - https://rubygems.org/gems/mcp/versions/0.23.0
     - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
     - https://docs.ruby-lang.org/en/3.3/IO.html#method-i-gets
+    - https://github.com/modelcontextprotocol/ruby-sdk/commit/267b8fa6285453525c81ce43db6b7dcd7a8a8c2f
+    - https://advisories.gitlab.com/gem/mcp/CVE-2026-63119
+    - https://osv.dev/vulnerability/GHSA-7683-3w9x-ch42
     - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42
 notes: |
-  - cvss_v3 came from GHSA.
+  - cvss_v3 from GHSA
   - date from gem release

gems/mcp/CVE-2026-67430.yml

@@ -0,0 +1,49 @@
+---
+gem: mcp
+cve: 2026-67430
+ghsa: 52jp-gj8w-j6xh
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-67430
+title: Unbounded session retention in StreamableHTTPTransport allows
+  memory exhaustion via initialize flood
+date: 2026-07-07
+description: |
+  ## Summary
+
+  In its default configuration, MCP::Server::Transports::StreamableHTTPTransport
+  never expires sessions. Every successful initialize request stores a
+  new ServerSession and a session record under a fresh UUID, and the
+  only path that removes them is an explicit client-issued HTTP DELETE.
+  An unauthenticated attacker can repeatedly initialize new sessions
+  and immediately disconnect, forcing the server to retain an unbounded
+  number of ServerSession objects until memory is exhausted.
+
+  ## Impact
+
+  - **Attacker requirements:** unauthenticated TCP reach of the MCP
+     endpoint. No session, no credentials.
+
+  - **Effect:** memory-exhaustion denial of service. A sustained or
+    distributed attacker can OOM the worker; on services that recycle
+    workers, the attacker simply repeats. On multi-tenant gateways, one
+    tenant can starve all others.
+
+  - **Affected deployments:** every deployment that does not opt into
+    `session_idle_timeout`. Because the README presents this as an
+    opt-in mitigation rather than a default, real-world deployments
+    are likely to ship vulnerable.
+cvss_v3: 5.3
+patched_versions:
+  - ">= 0.23.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-67430
+    - https://rubygems.org/gems/mcp/versions/0.23.0
+    - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
+    - https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4
+    - https://advisories.gitlab.com/gem/mcp/CVE-2026-67430
+    - https://osv.dev/vulnerability/GHSA-52jp-gj8w-j6xh
+    - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
+    - https://github.com/advisories/GHSA-52jp-gj8w-j6xh
+notes: |
+  - cvss_v3 from GHSA
+  - date from gem release

gems/mcp/GHSA-5p9g-j988-pcwv.yml → gems/mcp/CVE-2026-67431.yml

@@ -1,8 +1,9 @@
 ---
 gem: mcp
+cve: 2026-67431
 ghsa: 5p9g-j988-pcwv
-url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv
-title: Ruby SSE Session Poisoning
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-67431
+title: MCP Ruby SDK - Ruby SSE Session Poisoning
 date: 2026-07-07
 description: |
   ## Summary
@@ -12,13 +13,27 @@ description: |
   with a stolen session ID can execute tools with the victim's session.
   This is a silent attack - the victim's session is compromised and
   being used for unauthorized actions, but it is hard to know for the victim.
+
+  ## Impact
+
+  - **Integrity:** HIGH - Attacker can execute unauthorized tools and
+    modify state.
+
+  - **Availability:** LOW - Attacker can disrupt victim's session with
+    injected responses.
+cvss_v4: 8.3
 patched_versions:
   - ">= 0.23.0"
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-67431
     - https://rubygems.org/gems/mcp/versions/0.23.0
     - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
+    - https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356
+    - https://advisories.gitlab.com/gem/mcp/CVE-2026-67431
+    - https://osv.dev/vulnerability/GHSA-5p9g-j988-pcwv
     - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv
+    - https://github.com/advisories/GHSA-5p9g-j988-pcwv
 notes: |
-  - Project GHSA has high severity.
+  - cvss_v4 from GHSA; Project GHSA has high severity.
   - date from gem release

gems/mcp/CVE-2026-67432.yml

@@ -0,0 +1,49 @@
+---
+gem: mcp
+cve: 2026-67432
+ghsa: h669-8m4g-r2hc
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-67432
+title: Unbounded JSON-RPC request body causes uncontrolled memory
+  allocation in StreamableHTTPTransport
+date: 2026-07-07
+description: |
+  ## Summary
+
+  An unauthenticated remote attacker can force any MCP Ruby SDK server
+  using MCP::Server::Transports::StreamableHTTPTransport to allocate
+  gigabytes of memory by sending a single oversized JSON-RPC POST. The
+  transport reads the entire HTTP body into a Ruby String and parses
+  it with JSON.parse(body, symbolize_names: true) with no size limit,
+  no Content-Length pre-check, and no streaming parser, allowing
+  trivial denial of service against the worker process.
+
+  ## Impact
+
+  - **Attacker requirements:** none beyond TCP reach of the MCP
+    endpoint. No session, no credentials, no prior interaction.
+
+  - **Effect:** memory-exhaustion denial of service. A single request
+    can take a worker offline; sustained low-rate requests keep the
+    service down across worker restarts. On multi-tenant deployments a
+    single attacker tenant can starve neighbours.
+
+  - **Affected deployments:** every server mounting
+    `MCP::Server::Transports::StreamableHTTPTransport` as a Rack
+     app — the canonical HTTP deployment pattern. Both stateful
+     and `stateless: true` configurations are affected.
+cvss_v3: 7.5
+patched_versions:
+  - ">= 0.23.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-67432
+    - https://rubygems.org/gems/mcp/versions/0.23.0
+    - https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
+    - https://github.com/modelcontextprotocol/ruby-sdk/commit/772e0cb1f9db69312006926eee59a7287ad50166
+    - https://advisories.gitlab.com/gem/mcp/CVE-2026-67432
+    - https://osv.dev/vulnerability/GHSA-h669-8m4g-r2hc
+    - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc
+    - https://github.com/advisories/GHSA-h669-8m4g-r2hc
+notes: |
+  - cvss_v3 from GHSA
+  - date from gem release