A lack of input size limits in the MCP Ruby SDK’s stdio transport allows a peer that sends data without a newline to trigger unlimited buffering of incoming data, causing the process to allocate increasing amounts of memory until it exhausts system resources or the VM crashes. This behavior satisfies the criteria for both Unrestricted Resource Consumption (CWE‑400) and Allocation of Resources without Limits (CWE‑770), and results in a denial‑ofservice condition that compromises availability of the host process.

The vulnerability affects the Model Context Protocol Ruby SDK (ModelContextProtocol: Ruby‑SDK) in all releases prior to version 0.23.0. Any application or service that imports or uses the MCP::Server::Transports::StdioTransport or MCP::Client::Stdio components through these older versions is susceptible.

The CVSS score of 6.2 indicates a medium severity; the EPSS score of less than 1% reflects a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a malicious peer capable of communicating with the stdio transport on either side of the protocol, supplying data without a newline to induce memory exhaustion. Once the memory is consumed, the process will fail or restart, leading to a denial‑of‑service state for any client or server using the SDK.