CVE-2026-108714 MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB...

EUVD-2026-96988

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB...

CVE-2026-108714

The MCP Kotlin SDK (versions through 0.15.0 ) is vulnerable to a memory exhaustion issue via the Application.mcpWebSocket component. The root cause is that the SDK installs Ktor WebSockets without enforcing a maxFrameSize limit. An attacker can exploit this by sending small frame headers that dec...