8.7
Élevée
CVE-2026-108714 MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to…
Description
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| kotlin-sdk 0.15 | premières → 0.15.0 | Pas de correctif indiqué |
Références
- hackmd.io hackmd.io
- github.com github.com
- github.com github.com
- github.com github.com
- VulnCheck Advisory: MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket www.vulncheck.com
Chronologie
- Publiée
- Dernière modification