MCP Ruby SDK: Potential Memory Exhaustion via Session Flood
An early warning has been issued regarding a potential vulnerability in the MCP Ruby SDK's StreamableHTTPTransport. This issue reportedly allows an unauthenticated attacker to repeatedly initialize new sessions, potentially leading to unbounded memory usage and exhaustion.
What happened
The MCP Ruby SDK is under investigation for a vulnerability in its StreamableHTTPTransport component. This vulnerability appears to permit unauthenticated attackers to repeatedly initialize new sessions, which are not subject to expiration by default. As a result, this could lead to unbounded memory usage and potential exhaustion of system resources.
The default configuration of the MCP Ruby SDK does not expire sessions automatically, and the only removal path is through an explicit client-issued HTTP DELETE request. This design flaw may be exploited to flood the system with session initializations, thereby consuming all available memory.
To assess your exposure, review your use of the MCP Ruby SDK and check if you are utilizing the StreamableHTTPTransport component. It is recommended to set a `session_idle_timeout` to mitigate session hijacking risks and prevent memory exhaustion. For more detailed information, consult the primary sources linked in the advisory.
How 0Day mitigates this
mcp ruby sdk is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.