modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server vulnerabilities

Latest modelcontextprotocol io.modelcontextprotocol:kotlin-sdk-server CVEs

Newest publication first

1. CVE-2026-53937 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

   Published 2026-09-08

   Medium·CVSS 6.2 EPSS 0.19%

   MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes rec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.