GHSA-h669-8m4g-r2hc (mcp): Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
21-Jul-2026 1
Originally appeared on RubySec.## Summary An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTT...
GHSA-h669-8m4g-r2hc (mcp): Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport #ruby #rubydeveloper #rubyonrails #ruby #rubyonrails #programming #webdev #ghsa-h669-8m4g-r2hc #(mcp): https://www.rubyonrails.ba/link/ghsa-h669-8m4g-r2hc-mcp-unbounded-json-rpc-request-body-causes-uncontrolled-memory-allocation-in-streamablehttptransport