ruby-sdk

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportCVE-2026-67432modelcontextprotocol · CVSS 7.5 · 0.8% likely

   CWE-770

2. MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID ReplayCVE-2026-33946modelcontextprotocol · CVSS 8.2 · 0.5% likely

   CWE-384

3. MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize floodCVE-2026-67430modelcontextprotocol · CVSS 5.3 · 0.4% likely

   CWE-401

4. MCP Ruby SDK: Ruby SSE Session PoisoningCVE-2026-67431modelcontextprotocol · CVSS 8.3 · 0.4% likely

   CWE-284

5. MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protectionCVE-2026-63118modelcontextprotocol · CVSS 6.9 · 0.2% likely

   CWE-346

6. MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)CVE-2026-63119modelcontextprotocol · CVSS 6.2 · 0.2% likely

   CWE-770

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.