THREAT OPS › Threat News › [GHSA] GHSA-7683-3w9x-ch42 (medium) — MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
[GHSA] GHSA-7683-3w9x-ch42 (medium) — MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
GHSA-7683-3w9x-ch42 Severity: medium CVE: CVE-2026-63119
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
## Summary
The stdio transports in `MCP::Server::Transports::StdioTransport` and `MCP::Client::Stdio` read newline-delimited JSON-RPC frames using `IO#gets` with no `limit` argument. CRuby's `IO#gets` with no limit reads from the current position unti
Indicators of compromise
- CVE-2026-63119cve
Original source: https://github.com/advisories/GHSA-7683-3w9x-ch42