GHSA-52jp-gj8w-j6xh (mcp): Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
21-Jul-2026 2
Originally appeared on RubySec.## Summary In its default configuration, MCP::Server::Transports::StreamableHTTPTransport never expires sessions. Every successful initialize request stores a new ServerSession and a session record under a fresh UUID, and the only path that remov...
