CVE-2026-63119: MCP Ruby SDK DOS Vulnerability

CVE-2026-63119 Overview

CVE-2026-63119 is a resource exhaustion vulnerability in the MCP Ruby SDK, the official Ruby implementation for Model Context Protocol servers and clients. Versions prior to 0.23.0 of the mcp gem use Ruby's IO#gets method without a byte limit inside MCP::Server::Transports::StdioTransport and MCP::Client::Stdio. A peer that sends data over stdio without a terminating newline can force the process to accumulate bytes indefinitely, exhausting host memory. The flaw is tracked as [CWE-400: Uncontrolled Resource Consumption]. Version 0.23.0 remediates the issue by bounding frame reads with a max_line_bytes parameter.

Critical Impact
A local peer connected over stdio can trigger an out-of-memory condition, causing the Ruby MCP server or client process to be OOM-killed and disrupting Model Context Protocol availability.

Affected Products

mcp Ruby gem versions prior to 0.23.0
MCP::Server::Transports::StdioTransport component
MCP::Client::Stdio component

Discovery Timeline

2026-07-29 - CVE-2026-63119 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-63119

Vulnerability Analysis

The vulnerability resides in the stdio transport layer of the MCP Ruby SDK. Both MCP::Server::Transports::StdioTransport and MCP::Client::Stdio read newline-delimited JSON-RPC frames from a peer's standard output stream. The read path invokes CRuby's IO#gets without a byte cap. IO#gets blocks and accumulates every byte received into a single Ruby String object until a newline character (\n) arrives or the stream closes.

A peer that writes bytes over stdio but never emits a newline forces the receiver to grow this String without bound. The Ruby process consumes memory proportional to the attacker's transmitted volume until the kernel OOM-killer terminates it. The attack requires local access to the stdio channel between MCP peers.

Root Cause

The root cause is missing input length validation on a streaming read primitive. IO#gets in CRuby returns only when a delimiter is found or EOF occurs. Without the second limit argument to IO#gets, no upper bound is enforced. Any protocol that trusts a peer to eventually terminate a frame becomes a memory exhaustion vector when that peer is malicious or misbehaving.

Attack Vector

Exploitation requires a peer process communicating with a vulnerable MCP endpoint over stdio. The attacker's spawned server or client writes an arbitrarily large stream of bytes to stdout without inserting \n. The victim's IO#gets call accumulates the payload in a single String until memory is exhausted and the OS terminates the process. Availability of the MCP integration is lost until the process is restarted.

ruby

       CLOSE_TIMEOUT = 2
       STDERR_READ_SIZE = 4096
 
+      # Default upper bound on a single newline-delimited frame read from the
+      # server's stdout. CRuby's `IO#gets` without a limit accumulates bytes until a
+      # newline arrives, so a spawned server that never emits one can grow a single
+      # String until the host process is OOM-killed. 4 MiB is large enough for any
+      # realistic JSON-RPC frame, including base64-embedded images.
+      MAX_LINE_BYTES = 4 * 1024 * 1024
+
       attr_reader :command, :args, :env, :server_info
 
-      def initialize(command:, args: [], env: nil, read_timeout: nil)
+      def initialize(command:, args: [], env: nil, read_timeout: nil, max_line_bytes: MAX_LINE_BYTES)
+        # Reject `nil` or non-positive values: `IO#gets("\n", nil)` and a negative
+        # limit read without an upper bound, which would silently disable the
+        # protection this option exists to provide.
+        unless max_line_bytes.is_a?(Integer) && max_line_bytes > 0
+          raise ArgumentError, "max_line_bytes must be a positive Integer"
+        end
+
         @command = command
         @args = args
         @env = env
         @read_timeout = read_timeout
+        @max_line_bytes = max_line_bytes

Source: GitHub commit 267b8fa. The patch introduces a MAX_LINE_BYTES constant of 4 MiB and validates the parameter to prevent silent disablement.

Detection Methods for CVE-2026-63119

Indicators of Compromise

Ruby processes hosting the mcp gem terminated by the Linux OOM-killer, with corresponding entries in dmesg or /var/log/syslog referencing the Ruby runtime.
Rapid resident set size (RSS) growth in MCP server or client processes without a matching increase in legitimate request volume.
MCP peer connections that transmit large byte counts on stdout without newline delimiters.

Detection Strategies

Inventory Ruby applications and gem lockfiles (Gemfile.lock) for mcp versions below 0.23.0.
Monitor per-process memory consumption of Ruby workers running MCP transports and alert on sustained growth.
Correlate kernel OOM events with Ruby process identifiers to surface repeated crashes tied to MCP components.

Monitoring Recommendations

Collect and forward kernel logs, systemd journal entries, and Ruby application logs to a centralized store for correlation.
Track child-process spawn events from MCP hosts and audit the executables invoked as stdio peers.
Baseline normal JSON-RPC frame sizes for your MCP workloads and alert on outliers approaching multi-megabyte reads.

How to Mitigate CVE-2026-63119

Immediate Actions Required

Upgrade the mcp gem to version 0.23.0 or later in every Ruby application that uses MCP::Server::Transports::StdioTransport or MCP::Client::Stdio.
Audit the trust boundary of any process spawned as an MCP stdio peer, and restrict launch permissions to vetted binaries.
Add resource limits (ulimit -v, cgroup memory caps, or systemd MemoryMax=) around MCP host processes to contain any residual exposure.

Patch Information

The fix ships in mcp gem version 0.23.0. See the GitHub Release v0.23.0 notes and the GitHub Security Advisory GHSA-7683-3w9x-ch42 for full details. The patch adds a max_line_bytes initializer parameter that defaults to 4 MiB and rejects non-positive values.

Workarounds

If immediate upgrade is not possible, wrap MCP transports so that reads use IO#gets("\n", limit) with an explicit byte cap sized to your protocol needs.
Run MCP host processes under a memory-limited cgroup or container so an exhaustion attempt terminates the container rather than the host.
Restrict which local executables can be launched as MCP stdio peers, reducing the population of processes that can send unterminated streams.

bash

# Update the mcp gem to the patched release
bundle update mcp --conservative
grep -E '^\s*mcp\s+\(0\.23\.[0-9]+\)' Gemfile.lock

# Optional containment: cap memory for the MCP host service
systemd-run --scope -p MemoryMax=512M -p MemorySwapMax=0 \
  bundle exec ruby ./bin/mcp_server