GHSA-h669-8m4g-r2hc (mcp): Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

21-Jul-2026 2

Originally appeared on RubySec.## Summary An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTT...

RUBYONRAILS

to get 30% discount on our bundle!

Prepare for your next tech interview with our comprehensive collection of programming interview guides. Covering JavaScript, Ruby on Rails, React, and Python, these highly-rated books offer thousands of essential questions and answers to boost your interview success. Buy our 'Ultimate Job Interview Preparation eBook Bundle' featuring 2200+ questions across multiple languages.

Ultimate Job Interview Preparation eBook Bundle

GHSA-h669-8m4g-r2hc (mcp): Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

RUBYONRAILS

Bestseller

Tags

Related Links

Useful Links

Quick Links

Get in Touch