CVE Intelligence

Modelcontextprotocol Kotlin-sdk vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Modelcontextprotocol Kotlin-sdk: 1 record(s), with affected versions and fixes.

CVE-2026-108714 High · 7.5 CWE-770 Oct 11, 2026
MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.