Denial of Service Vulnerability in MCP Kotlin SDK by Model Context Protocol
CVE-2026-53937
What is CVE-2026-53937?
The MCP Kotlin SDK contains a denial of service vulnerability that stems from an unbounded growth of the internal buffer used for incoming byte streams. In versions 0.7.0 through 0.12.0, the implementation of ReadBuffer.append lacks a size cap, allowing the buffer to expand indefinitely if a peer sends data without introducing newline characters. This scenario can lead to an out-of-memory condition, especially when utilized in setups where untrusted sources can feed data to the SDK. This vulnerability is particularly concerning in environments utilizing the StdioServerTransport and StdioClientTransport, as they process incoming data via channels that lack proper memory management controls. The issue has been addressed in version 0.13.0.
Affected Version(s)
io.modelcontextprotocol:kotlin-sdk < 0.13.0
io.modelcontextprotocol:kotlin-sdk-client >= 0.7.0, < 0.13.0
io.modelcontextprotocol:kotlin-sdk-core < 0.13.0