Description
MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes every chunk of bytes received from the stdio transport into a `kotlinx.io.Buffer` with no size cap. Frames are extracted from that buffer only when a `\n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx.coroutines.channels.Channel<ByteArray>(Channel.UNLIMITED)` and then call `readBuffer.append(chunk)` without backpressure or size guard. This is a remote-pre-auth denial of service whenever an SDK stdio server's stdin is fed by an untrusted or attacker-controlled producer (for example: a host program that exec's the MCP server as a subprocess and pipes through bytes received from a network peer, or a sidecar wrapper that proxies bytes from an HTTP endpoint to the stdio transport). Version 0.13.0 fixes the issue.
Published: 2026-09-08
Score: 6.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service through memory exhaustion
Action: Upgrade
AI Analysis

Impact

The MCP Kotlin SDK contains an unbounded line buffer in its stdio transport modules. The ReadBuffer.append routine records every incoming byte sequence into an internal Kotlinx.io.Buffer without any size restriction, only discarding data when a newline character is encountered. An attacker can therefore stream bytes without ever sending a newline, causing the buffer to grow indefinitely until the process runs out of memory and is terminated. This flaw is classified as Resource Exhaustion (CWE-400) and Uncontrolled Memory Allocation (CWE-770).

Affected Systems

The vulnerability affects the MCP Kotlin SDK suite, including the core, client, server, and primary SDK components from modelcontextprotocol:io.modelcontextprotocol. Any installation of versions 0.7.0 through 0.12.0 is susceptible, while 0.13.0 and later contain the fix.

Risk and Exploitability

With a CVSS score of 6.2 the severity is moderate, and the EPSS score is not available, suggesting no quantified probability yet. The flaw is not listed in the CISA KEV catalog. Attacks require only an untrusted source feeding data into the stdio stdin of a running MCP Kotlin SDK process; no special privileges are required. Once the vulnerable transport is triggered, an attacker can cause the host JVM or surrounding process to be OOM‑killed, effectively denying service to legitimate users.

Generated by OpenCVE AI on September 9, 2026 at 08:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the MCP Kotlin SDK to version 0.13.0 or newer to apply the buffer size guard.
  • If upgrading is delayed, constrain or sanitize the stdio input stream by rejecting data streams that lack newline delimiters or by terminating the process when memory consumption grows beyond a safe threshold.
  • Implement a custom wrapper around the stdio transport that enforces a hard limit on the total bytes buffered or introduces backpressure, thereby preventing unbounded memory allocation.

Generated by OpenCVE AI on September 9, 2026 at 08:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Modelcontextprotocol
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-client
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-core
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server
Vendors & Products Modelcontextprotocol
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-client
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-core
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server

Tue, 08 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes every chunk of bytes received from the stdio transport into a `kotlinx.io.Buffer` with no size cap. Frames are extracted from that buffer only when a `\n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx.coroutines.channels.Channel<ByteArray>(Channel.UNLIMITED)` and then call `readBuffer.append(chunk)` without backpressure or size guard. This is a remote-pre-auth denial of service whenever an SDK stdio server's stdin is fed by an untrusted or attacker-controlled producer (for example: a host program that exec's the MCP server as a subprocess and pipes through bytes received from a network peer, or a sidecar wrapper that proxies bytes from an HTTP endpoint to the stdio transport). Version 0.13.0 fixes the issue.
Title MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
Weaknesses CWE-400
CWE-770
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Modelcontextprotocol Io.modelcontextprotocol:kotlin-sdk Io.modelcontextprotocol:kotlin-sdk-client Io.modelcontextprotocol:kotlin-sdk-core Io.modelcontextprotocol:kotlin-sdk-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-14T12:09:30.392Z

Reserved: 2026-06-11T15:46:12.318Z

Link: CVE-2026-53937

cve-icon Vulnrichment

Updated: 2026-09-14T12:09:25.474Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-09T00:17:31.407

Modified: 2026-09-14T13:18:40.033

Link: CVE-2026-53937

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T20:03:01Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling