CVE-2026-67432: MCP Ruby SDK DoS Vulnerability

CVE-2026-67432 Overview

CVE-2026-67432 is a memory exhaustion denial-of-service vulnerability in the MCP Ruby SDK, the official Ruby SDK for Model Context Protocol servers and clients. Versions prior to 0.23.0 contain a flaw in MCP::Server::Transports::StreamableHTTPTransport that reads and parses an entire JSON-RPC POST body without enforcing a size limit. An unauthenticated remote attacker can send an oversized request body to exhaust process memory and crash the worker. The issue is tracked as [CWE-770] (Allocation of Resources Without Limits or Throttling) and is fixed in mcp gem version 0.23.0.

Critical Impact
Unauthenticated remote attackers can trigger out-of-memory conditions in MCP servers by sending a single large POST body, causing service disruption.

Affected Products

MCP Ruby SDK (mcp gem) versions prior to 0.23.0
Applications embedding MCP::Server::Transports::StreamableHTTPTransport
Model Context Protocol servers built on the Ruby SDK

Discovery Timeline

2026-07-29 - CVE-2026-67432 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67432

Vulnerability Analysis

The MCP Ruby SDK exposes an HTTP transport intended to be mounted as a Rack application. Its handle_post method reads the full JSON-RPC request body into memory before parsing. Without a byte cap on the request body, a single unauthenticated POST can allocate gigabytes and trigger an out-of-memory (OOM) condition in the worker process. A related weakness exists in the client-side stdio transport, where oversized frames leave leftover bytes in the pipe, desyncing the stream. The classification under [CWE-770] reflects the lack of resource throttling on both untrusted input paths. Because the transport accepts network traffic and requires no authentication or user interaction, exploitation is trivial and repeatable.

Root Cause

The root cause is missing input size enforcement in the streamable HTTP transport. The server buffers the entire POST body prior to JSON parsing and does not bound nesting depth. Deeply nested payloads additionally amplify parse cost and can exhaust the stack.

Attack Vector

An attacker sends a crafted HTTP POST containing an arbitrarily large JSON-RPC payload to any endpoint served by StreamableHTTPTransport. The Ruby process allocates memory proportional to the payload size until the operating system kills the worker or the host becomes unresponsive. No credentials, session, or user interaction are required.

ruby

# Security patch: lib/mcp/server/transports/streamable_http_transport.rb
UNSET_IDLE_TIMEOUT = Object.new.freeze
private_constant :UNSET_IDLE_TIMEOUT

# Default upper bound on the JSON-RPC request body. `handle_post` reads the whole
# body into memory and parses it, so without a cap a single unauthenticated POST
# can allocate gigabytes and OOM the worker. 4 MiB comfortably
# fits a typical JSON-RPC request (a 4 MiB JSON string decodes to ~3 MiB of base64
# payload); raise `max_request_bytes:` for unusually large payloads. Matches the
# TypeScript SDK's 4 MB default.
DEFAULT_MAX_REQUEST_BYTES = 4 * 1024 * 1024

# Conservative bound on JSON nesting depth, so a deeply nested body cannot exhaust
# the stack or amplify parse cost (complements the byte cap).
MAX_JSON_NESTING = 64

Source: GitHub Commit 772e0cb

Detection Methods for CVE-2026-67432

Indicators of Compromise

Sudden spikes in Ruby process resident memory (RSS) followed by OOM-killer log entries referencing MCP worker processes.
HTTP POST requests to MCP endpoints with Content-Length values substantially larger than the 4 MiB default (4194304 bytes).
Repeated worker restarts or 5xx responses correlated with inbound traffic from a small set of source IPs.

Detection Strategies

Inspect reverse proxy or WAF logs for unusually large POST bodies directed at MCP transport routes.
Alert on Linux oom-kill kernel messages tied to Ruby application PIDs running the mcp gem.
Baseline normal JSON-RPC request sizes and flag statistical outliers.

Monitoring Recommendations

Track container and pod memory limits, restart counts, and OOMKilled events in Kubernetes environments hosting MCP servers.
Forward Rack access logs and system journal entries to a centralized data lake for correlation of request size against process termination events.
Monitor upstream network telemetry for repeated large-payload POSTs from single sources indicative of DoS attempts.

How to Mitigate CVE-2026-67432

Immediate Actions Required

Upgrade the mcp gem to version 0.23.0 or later across all servers and clients.
Audit deployed MCP services and their exposure to untrusted networks.
Place MCP endpoints behind a reverse proxy that enforces a request body size limit until upgrades complete.

Patch Information

The fix is available in mcp gem 0.23.0. The patch introduces DEFAULT_MAX_REQUEST_BYTES = 4 * 1024 * 1024 (4 MiB) and MAX_JSON_NESTING = 64 to bound both body size and JSON depth. See the GitHub Release v0.23.0 and the GitHub Security Advisory GHSA-h669-8m4g-r2hc for full details.

Workarounds

Enforce a request body size limit at the reverse proxy layer, for example client_max_body_size 4m; in NGINX.
Restrict MCP transport endpoints to authenticated clients or internal networks via network ACLs.
Set strict memory limits on worker processes and containers so OOM events are contained to a single worker rather than the host.

bash

# NGINX configuration example to bound MCP request bodies
server {
    listen 443 ssl;
    server_name mcp.example.com;

    location / {
        client_max_body_size 4m;
        client_body_buffer_size 128k;
        proxy_pass http://mcp_backend;
    }
}