Skip to content
CVE-2026-108714: Memory Allocation Vulnerability in MCP Kotlin SDK

CVE-2026-108714: Memory Allocation Vulnerability in MCP Kotlin SDK

First seen 11 Oct 2026, 17:30 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 12, 2026 at 00:02 UTC
  • •CVE-2026-108714 affects MCP Kotlin SDK version 0.15.0 and earlier.
  • •Attackers can exploit this vulnerability to cause denial of service by exhausting server memory.
  • •Immediate action is required to identify and remediate affected services.

The MCP Kotlin SDK version 0.15.0 contains an uncontrolled memory allocation vulnerability (CVE-2026-108714) that allows remote attackers to exhaust server memory via Ktor WebSockets without a maxFrameSize limit. Attackers can send crafted WebSocket frames with payloads near 2 GiB, leading to denial of service. This vulnerability affects internet-facing Kotlin services using the SDK's WebSocket server extension, particularly in shared or environments. There is no direct route to data theft, but service disruption is likely. Organizations are urged to identify exposed services and apply mitigations urgently. The vulnerability was published on 2026-10-11 with a CVSS score of 8.7, classified as high severity. No proof-of-concept or has been reported yet.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-11
CVE-2026-108714 published
The vulnerability was disclosed with a CVSS score of 8.7, indicating high severity.
Redpacketsecurity
2026-10-11
Vulnerability details reported
The MCP Kotlin SDK's uncontrolled memory allocation issue allows attackers to send oversized WebSocket frames.
hackmd.io

More articles in this cluster (3)

Following this threat?

Track CVE-2026-108714 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 2

Common questions

Which versions of the MCP Kotlin SDK are affected?
The vulnerability affects version 0.15.0 and potentially earlier releases.
What is the nature of the attack vector?
Attackers can exploit the vulnerability by sending oversized WebSocket frames to exhaust server memory.
What should organizations do to mitigate this vulnerability?
Organizations should identify affected deployments and apply the vendor's fix as soon as available.