CVE-2026-53937

MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

View on CVE.org
Published Sep 8, 2026 CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Description
MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes every chunk of bytes received from the stdio transport into a `kotlinx.io.Buffer` with no size cap. Frames are extracted from that buffer only when a `\n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx.coroutines.channels.Channel<ByteArray>(Channel.UNLIMITED)` and then call `readBuffer.append(chunk)` without backpressure or size guard. This is a remote-pre-auth denial of service whenever an SDK stdio server's stdin is fed by an untrusted or attacker-controlled producer (for example: a host program that exec's the MCP server as a subprocess and pipes through bytes received from a network peer, or a sidecar wrapper that proxies bytes from an HTTP endpoint to the stdio transport). Version 0.13.0 fixes the issue.

Analysis

AI-generated

Technical impact

The MCP Kotlin SDK contains an unbounded line buffer in its stdio transport modules. The ReadBuffer.append routine records every incoming byte sequence into an internal Kotlinx.io.Buffer without any size restriction, only discarding data when a newline character is encountered. An attacker can therefore stream bytes without ever sending a newline, causing the buffer to grow indefinitely until the process runs out of memory and is terminated. This flaw is classified as Resource Exhaustion (CWE-400) and Uncontrolled Memory Allocation (CWE-770).

Affected Systems

The vulnerability affects the MCP Kotlin SDK suite, including the core, client, server, and primary SDK components from modelcontextprotocol:io.modelcontextprotocol. Any installation of versions 0.7.0 through 0.12.0 is susceptible, while 0.13.0 and later contain the fix.

Risk and Exploitability

With a CVSS score of 6.2 the severity is moderate, and the EPSS score is not available, suggesting no quantified probability yet. The flaw is not listed in the CISA KEV catalog. Attacks require only an untrusted source feeding data into the stdio stdin of a running MCP Kotlin SDK process; no special privileges are required. Once the vulnerable transport is triggered, an attacker can cause the host JVM or surrounding process to be OOM‑killed, effectively denying service to legitimate users.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the MCP Kotlin SDK to version 0.13.0 or newer to apply the buffer size guard.
  • If upgrading is delayed, constrain or sanitize the stdio input stream by rejecting data streams that lack newline delimiters or by terminating the process when memory consumption grows beyond a safe threshold.
  • Implement a custom wrapper around the stdio transport that enforces a hard limit on the total bytes buffered or introduces backpressure, thereby preventing unbounded memory allocation.

Generated by OpenCVE AI on September 9, 2026 at 08:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Modelcontextprotocol
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-client
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-core
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server
Vendors & Products Modelcontextprotocol
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-client
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-core
Modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server
Type Values Removed Values Added
Description MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes every chunk of bytes received from the stdio transport into a `kotlinx.io.Buffer` with no size cap. Frames are extracted from that buffer only when a `\n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx.coroutines.channels.Channel<ByteArray>(Channel.UNLIMITED)` and then call `readBuffer.append(chunk)` without backpressure or size guard. This is a remote-pre-auth denial of service whenever an SDK stdio server's stdin is fed by an untrusted or attacker-controlled producer (for example: a host program that exec's the MCP server as a subprocess and pipes through bytes received from a network peer, or a sidecar wrapper that proxies bytes from an HTTP endpoint to the stdio transport). Version 0.13.0 fixes the issue.
Title MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
Weaknesses CWE-400
CWE-770
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Sep 14, 2026, 12:09 PM
Reserved
Jun 11, 2026, 3:46 PM

View source JSON

Updated
Sep 14, 2026, 12:09 PM

JSON

Status
Awaiting Analysis
Published
Sep 9, 2026, 12:17 AM
Modified
Sep 14, 2026, 1:18 PM

View source JSON

No data.

Updated
Sep 13, 2026, 8:03 PM

JSON