{"items":[{"id":"NVI-00015297","kind":"vulnerability","title":"MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7683-3w9x-ch42","CVE-2026-63119"],"plain_summary":"GitHub lists this reviewed advisory for mcp. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-563ae1645cfad2005a138a0227c7520b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-30T14:41:58.000Z","value":"6.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-563ae1645cfad2005a138a0227c7520b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-563ae1645cfad2005a138a0227c7520b","url":"https://github.com/advisories/GHSA-7683-3w9x-ch42","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7683-3w9x-ch42","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:58:49.818Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-563ae1645cfad2005a138a0227c7520b"],"technology":"mcp","known_exclusions":[],"conditions_summary":"## Summary\n\nThe stdio transports in `MCP::Server::Transports::StdioTransport` and `MCP::Client::Stdio` read newline-delimited JSON-RPC frames using `IO#gets` with no `limit` argument. CRuby's `IO#gets` with no limit reads from the current position until the next separator (`\\n`) with no upper bound on the returned string length. A peer that streams bytes without ever emitting a newline causes `gets` to accumulate the entire stream in a single Ruby `String` until the process is killed by the operating-system OOM killer.\n\nThis is the same vulnerability class tracked in sibling MCP SDKs as GHSA-74gp-qhv5-v493 (Kotlin), GHSA-wqgc-pwpr-pq7r (TypeScript), GHSA-655q-2283-6jgj (Python), and others. It was identified during a cross-SDK audit; ruby-sdk had no prior report.\n\n## Affected code\n\nVerified at `main` @ `cf44475c`.\n\n### Server transport — `lib/mcp/server/transports/stdio_transport.rb`\n\n```ruby\n# line 23\nwhile @open && (line = $stdin.gets)        # <-- no limit argument\n  response = @session.handle_json(line.strip)\n  ...\n\n# line 76\nwhile @open && (line = $stdin.gets)        ","public_affected_ranges":["<= 0.22.0"]}],"null_published_at":"2026-11-03T10:03:26.568Z","source_updated_at":"2026-07-30T14:41:58.000Z","source_disclosed_at":"2026-07-30T14:41:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T09:58:49.818Z"}],"next_cursor":null,"snapshot_revision":"42594"}