CVE-2026-67432

CVE-2026-67432 is a memory exhaustion vulnerability in the official Ruby SDK for Model Context Protocol (MCP), versions prior to 0.23.0. The vulnerability exists in the JSON-RPC transport layer: incoming POST requests with no size validation on the body allow an attacker to send arbitrarily large payloads that exhaust server memory during JSON parsing. If you're running an MCP Ruby server in production, check your version immediately — versions before 0.23.0 are vulnerable. The 0.23.0 release added a max-content-length header check that rejects requests exceeding a configured size limit before parsing begins. The CVSS score of 7.5 reflects the direct DoS impact, but the EPSS probability of 0.43% is likely misleading. MCP servers are typically embedded in AI pipelines rather than exposed as standalone web services, which means traditional internet scanning won't detect them. This doesn't mean the vulnerability is unreachable — it means the deployment topology differs from what EPSS calibrates against. The fix in 0.23.0 is a boundary check at the HTTP transport layer, not a streaming JSON parser with progressive memory limits. That's an important distinction: the vulnerability class is unbounded resource consumption during parsing, and the patch addresses the symptom at the entry point rather than the root cause inside the JSON processing layer. If you're deploying MCP servers, you should layer additional controls: enforce content-length limits at your load balancer or API gateway, implement request size limits in any reverse proxy fronting the MCP server, and consider adding application-level memory budgets for JSON parsing operations. The practical risk depends on your architecture. If your MCP server is exposed to untrusted network paths, this is a straightforward DoS vector to patch. If it's only accessed by trusted upstream AI orchestration, the immediate exploitability is lower — but the vulnerability still represents a resource boundary failure that could become problematic as MCP deployment scales.

Reviewed through automated stages and approved by a human before publication.