CVE-2026-108714

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

October 11, 2026

Last Seen

October 11, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

CVE-2026-108714: Memory Allocation Vulnerability in MCP Kotlin SDK64.5

The MCP Kotlin SDK version 0.15.0 contains an uncontrolled memory allocation vulnerability (CVE-2026-108714) that allows remote attackers to exhaust server memory via Ktor WebSockets without a maxFrameSize limit. Attackers can send crafted WebSocket frames with payloads near 2 GiB, leading to denial...