HIGH 8.7 NVD
CVE-2026-108714
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.m
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.
References
- https://github.com/modelcontextprotocol/kotlin-sdk
- https://github.com/modelcontextprotocol/kotlin-sdk/blob/0.15.0/kotlin-sdk-core/src/commonM
- https://github.com/modelcontextprotocol/kotlin-sdk/blob/0.15.0/kotlin-sdk-server/src/commo
- https://hackmd.io/@haind/mcp-kotlin-sdk-websocket-frame-allocation-dos
- https://www.vulncheck.com/advisories/mcp-kotlin-sdk-through-0.15.0-memory-exhaustion-via-a
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-11 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.