{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/mcp--0.22.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-67432"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mcp (\u003c= 0.22.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["RubyGems"],"content_html":"\u003cp\u003eThe MCP Ruby SDK contains a vulnerability in the \u003ccode\u003eStreamableHTTPTransport\u003c/code\u003e and \u003ccode\u003eStdioTransport\u003c/code\u003e components that allows for trivial denial-of-service (DoS) via memory exhaustion. The vulnerability stems from the \u003ccode\u003ehandle_post\u003c/code\u003e method, which reads the entire body of an incoming HTTP request into memory using \u003ccode\u003erequest.body.read\u003c/code\u003e without any size constraints or pre-validation of the \u003ccode\u003eContent-Length\u003c/code\u003e header. Subsequently, the application calls \u003ccode\u003eJSON.parse\u003c/code\u003e with \u003ccode\u003esymbolize_names: true\u003c/code\u003e on the entire payload. Because \u003ccode\u003esymbolize_names\u003c/code\u003e creates a Ruby symbol for every JSON key, the memory consumption is significantly amplified beyond the raw size of the payload. This vulnerability is reachable without authentication, making it accessible to any unauthenticated remote attacker with network reach to the MCP server. Successfully sending a single large payload can drive a worker process to consume gigabytes of memory, leading to OOM-termination.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an MCP Ruby SDK server exposing the \u003ccode\u003eStreamableHTTPTransport\u003c/code\u003e interface.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious JSON-RPC POST request with a large payload (e.g., several hundred megabytes).\u003c/li\u003e\n\u003cli\u003eAttacker sends the HTTP request to the target server's endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eStreamableHTTPTransport\u003c/code\u003e component receives the request and executes \u003ccode\u003erequest.body.read\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application loads the entirety of the attacker-supplied payload into a Ruby \u003ccode\u003eString\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eJSON.parse\u003c/code\u003e method executes on the full payload, creating a large object graph and numerous symbols.\u003c/li\u003e\n\u003cli\u003eThe server process memory usage spikes dramatically, consuming system resources.\u003c/li\u003e\n\u003cli\u003eThe worker process crashes or is terminated due to OOM (Out of Memory) conditions, resulting in denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows any unauthenticated attacker with network access to crash individual worker processes of an MCP Ruby SDK application. By repeatedly sending these malicious requests, an attacker can maintain a persistent DoS state. In multi-tenant environments, this vulnerability enables an attacker to starve shared server resources, potentially impacting services running alongside the vulnerable worker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for mitigation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003emcp\u003c/code\u003e gem to a version containing the patch for CVE-2026-67432 once available.\u003c/li\u003e\n\u003cli\u003eImplement an inbound request size limit at the reverse proxy or web server layer (e.g., Nginx \u003ccode\u003eclient_max_body_size\u003c/code\u003e) to drop requests exceeding a reasonable threshold (e.g., 4 MiB) before they reach the Ruby application.\u003c/li\u003e\n\u003cli\u003eApply middleware in the Rack application to validate the \u003ccode\u003eContent-Length\u003c/code\u003e header before reading the request body.\u003c/li\u003e\n\u003cli\u003eConfigure the application to use a streaming JSON parser rather than loading the full request body into memory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-30T15:30:16Z","date_published":"2026-07-30T15:30:16Z","id":"https://feed.craftedsignal.io/briefs/2026-07-mcp-ruby-oom/","summary":"An unauthenticated remote attacker can cause a denial-of-service in MCP Ruby SDK servers by sending oversized JSON-RPC requests that trigger unbounded memory allocation.","title":"Uncontrolled Memory Allocation in MCP Ruby SDK","url":"https://feed.craftedsignal.io/briefs/2026-07-mcp-ruby-oom/"}],"language":"en","title":"CraftedSignal Threat Feed - Mcp (\u003c= 0.22.0)","version":"https://jsonfeed.org/version/1.1"}