CVE-2026-53937

CVE-2026-53937 affects the MCP Kotlin SDK (versions 0.7.0–0.12.0 ). The root cause is an unbounded kotlinx.io.Buffer in ReadBuffer.append, which grows indefinitely when the stdio transport receives a byte stream without a terminating newline. The issue is amplified by StdioServerTransport and Std...

EUVD-2026-74297

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...