{"schema":"threatline.record/2","record":{"id":"CVE-2026-108714","aliases":[],"summary":"MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket","details":"MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.","categories":["Unclassified"],"product":"kotlin-sdk","vendor":"modelcontextprotocol","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108714","source_modified_at":"2026-10-14T13:23:01.451Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"kotlin-sdk","vendor":"modelcontextprotocol","versions":[{"version":"0","lessThanOrEqual":"0.15.0","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00358,"percentile":0.28335,"score_date":"2026-10-23"},"published_at":"2026-10-11T12:19:27.291Z","modified_at":"2026-10-14T13:23:01.451Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108714","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T13:23:01.451Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108714","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind/mcp-kotlin-sdk-websocket-frame-allocation-dos","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/kotlin-sdk/blob/0.15.0/kotlin-sdk-server/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/server/WebSocketMcpKtorServerExtensions.kt#L41-L63","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/kotlin-sdk/blob/0.15.0/kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/WebSocketMcpTransport.kt#L60-L85","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/kotlin-sdk","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/mcp-kotlin-sdk-through-0.15.0-memory-exhaustion-via-application-mcpwebsocket","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-14T13:22:52.401475Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T13:23:01.451Z","content_hash":"616fa77054958d111c53180efb5024a8e78fdee05ebcdb06ee5ce33751de498f"}}