modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server vulnerabilities (CVE)

CVE records published for modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server, newest first. Follow to get an email when a new one appears.

1 results
6.2Medium
CVE-2026-53937

MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

modelcontextprotocol io.modelcontextprotocol:kotlin-sdk; modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-client; modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-core; modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes…