CVE-2026-86040

A flaw was found in the floodsub component of libp2p. The package accepts unauthenticated Remote Procedure Call RPC frames without properly enforcing limits on subscription elements and processes them synchronously. A remote unauthenticated attacker can exploit this vulnerability by sending...

Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

Summary The stdio transports in MCP::Server::Transports::StdioTransport and MCP::Client::Stdio read newline-delimited JSON-RPC frames using IOgets with no limit argument. CRuby's IOgets with no limit reads from the current position until the next separator \n with no upper bound on the returned...