MCP Kotlin SDK: Uncontrolled memory allocation in WebSocket transport
Summary
The MCP Kotlin SDK through 0.15.0 installs Ktor WebSockets in Application.mcpWebSocket without a maxFrameSize limit. A remote client can send small frame headers that declare payloads close to 2 GiB, forcing the server to make huge heap allocations over one or a few connections. This can exhaust server memory and cause a denial of service. Confidentiality and integrity are not affected.
Affected
- MCP Kotlin SDK through 0.15.0 (Maven: io.modelcontextprotocol:kotlin-sdk, kotlin-sdk-server and related packages)
- Start of the affected range: Unknown.
Fixed in
- Unknown. A fix in 0.16.0 is reported by a secondary source only and is not confirmed in the official release notes. Check the official release page before updating.
Workaround
- Set an explicit maxFrameSize in your own code when installing WebSockets, including for the Route.mcpWebSocket overload.
- Restrict access to the MCP endpoint to trusted networks, or place a reverse proxy with request size limits in front of it.
Exploitation
- No evidence of active exploitation in the wild. The CVE is not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- VulDB reports no known exploit. A technical write-up exists but has not been verified.
Our recommendation
- Check lockfiles and build files for io.modelcontextprotocol:kotlin-sdk.
- Identify MCP servers that use the WebSocket transport and whether they are reachable from untrusted networks.
- Update to a fixed release once confirmed, or set maxFrameSize explicitly.
- Priority: medium for internet-facing MCP WebSocket servers, low otherwise.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MCP Kotlin SDK repository github.com
- WebSocketMcpTransport.kt at 0.15.0 github.com
- VulnCheck advisory: MCP Kotlin SDK memory exhaustion www.vulncheck.com
- HackMD write-up on WebSocket frame allocation DoS hackmd.io
- OSV entry CVE-2026-108714 osv.dev
- Pull request #1129 (bound inbound WebSocket message size) github.com
- Tenable CVE-2026-108714 www.tenable.com
- VulDB entry 416616 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:04.
Original description (NVD)
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.
NVD references (5)
- https://github.com/modelcontextprotocol/kotlin-sdk
- https://github.com/modelcontextprotocol/kotlin-sdk/blob/0.15.0/kotlin-sdk-core/src/commonMain/kotlin/io/model…
- https://github.com/modelcontextprotocol/kotlin-sdk/blob/0.15.0/kotlin-sdk-server/src/commonMain/kotlin/io/mod…
- https://hackmd.io/@haind/mcp-kotlin-sdk-websocket-frame-allocation-dos
- https://www.vulncheck.com/advisories/mcp-kotlin-sdk-through-0.15.0-memory-exhaustion-via-application-mcpwebso…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.