CVE-2026-108714
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.
Risk Assessment
The organization is exposed to denial of service (DoS) by remote clients who can exhaust server memory and render it inoperable. This can lead to service unavailability and business disruption.
Recommendation
Upgrade MCP Kotlin SDK beyond 0.15.0 if available, and configure a maxFrameSize limit for WebSockets. Consider limiting the number of connections and monitoring memory usage.
Other vulnerabilities in MCP Kotlin SDK
Original NVD description (English source)
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS