GHSA-7683-3w9x-ch42 MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
SummaryThe stdio transports in `MCP::Server::Transports::StdioTransport` and `MCP::Client::Stdio` read newline-delimited JSON-RPC frames using `IO#gets` with no `limit` argument. CRuby's `IO#gets` with no limit reads from the current position until the next separator (`\n`) with no upper bound on the returned string length. A peer that streams bytes without ever emitting a newline causes `gets` to accumulate the entire stream in a single Ruby `String` until the process is killed by the operating-system OOM killer.This is the same vulnerability class tracked in sibling MCP SDKs as GHSA-74gp-qhv5-v493 (Kotlin), GHSA-wqgc-pwpr-pq7r (TypeScript), GHSA-655q-2283-6jgj (Python), and others. It was identified during a cross-SDK audit; ruby-sdk had no prior report.Affected codeVerified at `main` @ `cf44475c`.Server transport — [`lib/mcp/server/transports/stdio_transport.rb`](https://github.com/modelcontextprotocol/ruby-sdk/blob/cf44475c/lib/mcp/server/transports/stdio_transport.rb)`$stdin` is the raw process global (only `set_encoding` is applied at line 16); there is no wrapper imposing a length limit.Client transport — [`lib/mcp/client/stdio.rb`](https://github.com/modelcontextprotocol/ruby-sdk/blob/cf44475c/lib/mcp/client/stdio.rb)`@stdout` is the raw `IO` returned by `Open3.popen3`. The `@read_timeout` guard at line 227 (`wait_for_readable!`) only gates the `IO.select` before `gets` is invoked; once bytes are flowing, `gets` blocks indefinitely accumulating into one string.ImpactDenial of service via memory exhaustion. A peer that controls the byte stream delivered to the stdio transport can grow a single Ruby `String` until the process exhausts available memory.**Threat-model caveat (important):** In the default stdio deployment, the peer process already holds local execution privileges equal to or greater than the victim:On the **server** side (`StdioTransport#open`), the writer to `$stdin` is the parent process that spawned the server, which already holds `Process.kill`, environment control, and filesystem access over the child. This direction is a robustness defect rather than a security boundary in typical deployments.On the **client** side (`Client::Stdio#read_response`), the writer is the third-party MCP server binary the host application chose to spawn via `Open3.popen3`. In an unsandboxed deployment that binary already has local code execution as the host user.This issue is primarily a security concern for:(a) host applications that **sandbox** the spawned MCP server (container, restricted user, seccomp) while piping its stdout to an unsandboxed host process — an unbounded `gets` lets a memory-capped sandboxed process exhaust the unconstrained host;(b) **HTTP-to-stdio bridge** deployments that forward bytes from a remote peer to a stdio server's stdin (note: surveyed bridges re-frame JSON-RPC and emit their own newlines, mitigating this in practice);(c) **robustness** against non-malicious servers that emit large unterminated output (misconfigured logging to stdout, runaway loops), which can crash the host process and all other MCP sessions it manages.The bug fires before the JSON-RPC `initialize` handshake, since `gets` cannot return until `\n` arrives.ReproductionObserved: process RSS grows linearly with bytes produced; `gets` never returns; process is OOM-killed.Suggested fix`IO#gets` accepts a second `limit` argument. Apply a configurable maximum line length (default suggested: 4 MiB — large enough for any realistic JSON-RPC frame including base64-embedded images) at all three call sites, and treat an over-limit line as a transport error that closes the connection:Apply the same pattern at `stdio_transport.rb:76` and `client/stdio.rb:228`. Expose `MAX_LINE_BYTES` as a constructor option on both transports for callers with legitimate large-frame needs.CreditIdentified during a cross-SDK audit of the stdio unbounded-buffer vulnerability class, prompted by GHSA-74gp-qhv5-v493 (reporter: tonghuaroot).
CVSS v3.1 score: 6.2