CVE-2026-108714

The MCP Kotlin SDK (versions through 0.15.0 ) is vulnerable to a memory exhaustion issue via the Application.mcpWebSocket component. The root cause is that the SDK installs Ktor WebSockets without enforcing a maxFrameSize limit. An attacker can exploit this by sending small frame headers that dec...