Mmastodon TechnologyCybersecurity first seen 1 d ago, last 1 d ago, peak #12

MCP Kotlin SDK vulnerability lets attackers exhaust server memory

Original: 🟠 CVE-2026-108714 - High (7.5) MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability th

A high-severity vulnerability, CVE-2026-108714, has been disclosed in the MCP Kotlin SDK through version 0.15.0. The flaw scores 7.5 and involves uncontrolled memory allocation: Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit, allowing remote clients to send oversized frames that exhaust server memory. Developers using the SDK are being urged to review the issue and apply fixes or workarounds.

Why now: A newly disclosed high-severity remote denial-of-service flaw in a widely used SDK prompts developers to check whether their deployments are affected.

MCP Kotlin SDKKtorCVE-2026-108714

Open on mastodon →

Evidence

• 🟠 CVE-2026-108714 - High (7.5) MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send… · thehackerwire

API: https://socialmediatrends-api.osmike.com/v1/trends/1933841