Security: modelcontextprotocol/ruby-sdk
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
OAuth discovery security check allows SSRF to private hosts over HTTPSGHSA-4m5j-jjfc-97gx published
Aug 15, 2026 by koicModerate -
Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protectionGHSA-rjr6-rcgv-9m7m published
Jul 8, 2026 by koicModerate -
Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)GHSA-7683-3w9x-ch42 published
Jul 8, 2026 by koicModerate -
Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize floodGHSA-52jp-gj8w-j6xh published
Jul 8, 2026 by koicModerate -
Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportGHSA-h669-8m4g-r2hc published
Jul 8, 2026 by koicHigh -
Ruby SSE Session PoisoningGHSA-5p9g-j988-pcwv published
Jul 8, 2026 by koicHigh -
Lack of Session Hijacking protection in ruby-sdk - Stream Replacement VulnerabilityGHSA-qvqr-5cv7-wh35 published
Mar 27, 2026 by koicHigh