MCP Ruby SDK Stdio Transport Unbounded Read Memory Exhaustion
First seen Jul 30, 2026 · Updated Jul 30, 2026 · CVSS 6.2
The official MCP Ruby SDK (versions prior to 0.23.0) contains a denial-of-service vulnerability where its stdio transport reads input without a byte limit. A malicious peer (client or server) connected over stdio can send data without a newline terminator to exhaust the host process's memory, crashing or degrading the MCP server or client. This is a straightforward availability issue, not a code-execution or data-exfiltration flaw, and is fixed in 0.23.0.
Technical Analysis
MCP::Server::Transports::StdioTransport and MCP::Client::Stdio use Ruby's IO#gets to read newline-delimited messages from the stdio pipe, but do not enforce a maximum line length. An attacker controlling either end of the stdio channel (a rogue MCP client connecting to a server, or a compromised/malicious MCP server responding to a client) can stream an arbitrarily long sequence of bytes with no newline, causing IO#gets to buffer unbounded data in memory until the process is OOM-killed or becomes unresponsive. The entry point is the stdio transport layer itself, meaning any locally-spawned MCP process (a common integration pattern for desktop AI assistants and agent tool servers) is exposed to this if it accepts input from an untrusted or compromised counterpart. This crosses the process boundary between agent host and tool/server subprocess, turning a transport-layer parsing weakness into an availability attack against the hosting application or agent runtime.
Affected Systems
mcp (Ruby gem), MCP Ruby SDK; protocols: MCP
Detection Signatures
- Sustained memory growth in processes using MCP::Server::Transports::StdioTransport or MCP::Client::Stdio
- Stdio input stream with abnormally long lines lacking newline terminators
- MCP host process OOM kills or crashes correlated with subprocess I/O
- Use of mcp gem version < 0.23.0 in Gemfile.lock
Remediation Steps
- 1
Upgrade mcp gem
Update the mcp Ruby gem to version 0.23.0 or later, which enforces a byte limit on stdio reads.
- 2
Sandbox and resource-limit MCP subprocesses
Run MCP server/client subprocesses under cgroup or ulimit memory constraints so an unbounded read cannot exhaust host memory.
- 3
Validate transport peers
Only spawn or connect to trusted, vetted MCP server/client binaries over stdio; avoid accepting stdio connections from untrusted or dynamically fetched packages.
- 4
Add monitoring
Monitor memory usage and process health of MCP host applications to detect and auto-restart on abnormal growth.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.