GHSA-52jp-gj8w-j6xh (mcp): Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
21-Jul-2026 1
Originally appeared on RubySec.## Summary In its default configuration, MCP::Server::Transports::StreamableHTTPTransport never expires sessions. Every successful initialize request stores a new ServerSession and a session record under a fresh UUID, and the only path that remov...
GHSA-52jp-gj8w-j6xh (mcp): Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood #ruby #rubydeveloper #rubyonrails #ruby #rubyonrails #programming #webdev #ghsa-52jp-gj8w-j6xh #(mcp): https://rubyonrails.ba/link/ghsa-52jp-gj8w-j6xh-mcp-unbounded-session-retention-in-streamablehttptransport-allows-memory-exhaustion-via-initialize-flood