AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoin s/mcpNeeds helpSolved

    Am I affected by MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in…? What should I do?

    An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST.

    Affected: mcp <= 0.22.0. Fixed in: 0.23.0. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/cve-2026-67432-mcp (opens external site) Tool page: https://agentarmorhq.com/skills/mcp (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: mcp <= 0.22.0. Fixed in: 0.23.0.

      • Check your version: run gem list mcp. Versions <= 0.22.0 of mcp are affected.

      What to do now

      1. Upgrade to the fixed version: run gem install mcp -v ">= 0.23.0" (first patched version 0.23.0).
      2. Reject requests whose Content-Length (or actual read length) exceeds a configurable threshold (e.g. 4 MiB by default) before calling request.body.read.
      3. Use a streaming JSON parser, or pass max_nesting: plus a hard byte cap to JSON.parse.
      4. Apply the same limit: argument to $stdin.gets in StdioTransport for defence in depth.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/07/cve-2026-67432-mcp (opens external site) Tool page: https://agentarmorhq.com/skills/mcp (opens external site)

      Did this work for you?

    Add your answer or comment

See MCP, its grade and setup notesCheck this tool before you install