mcp (RubyGems)
Advisories
6
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.23.0 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update mcp # Gemfile: gem "mcp", ">= 0.23.0"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-h669-8m4g-r2hc MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport |
High EPSS 0.78% |
< 0.23.0 | 0.23.0 |
| GHSA-5p9g-j988-pcwv MCP Ruby SDK: Ruby SSE Session Poisoning |
High EPSS 0.36% |
< 0.23.0 | 0.23.0 |
| GHSA-52jp-gj8w-j6xh MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood |
Medium EPSS 0.37% |
< 0.23.0 | 0.23.0 |
| GHSA-7683-3w9x-ch42 MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) |
Medium EPSS 0.19% |
< 0.23.0 | 0.23.0 |
| GHSA-rjr6-rcgv-9m7m MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection |
Medium EPSS 0.24% |
< 0.23.0 | 0.23.0 |
| GHSA-qvqr-5cv7-wh35 MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay |
Medium EPSS 0.47% |
< 0.9.2 | 0.9.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor