CVE-2026-108714
Description
A flaw was found in the Model Context Protocol (MCP) Kotlin SDK. The server component configures WebSocket connections without enforcing a maximum frame size limit. A remote attacker can exploit this flaw by sending WebSocket frame headers that request excessively large payload allocations. This behavior forces the server to allocate excessive memory, resulting in memory exhaustion and a Denial of Service (DoS).
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger complete service unavailability through memory exhaustion without requiring elevated privileges. By dispatching crafted WebSocket framing packets that declare oversized data payloads, external clients can cause the application server to allocate massive heap buffers across a small number of connections. While confidentiality and data integrity remain unaffected, server processes implementing the MCP Kotlin transport layer become completely unresponsive or crash if exposed directly to untrusted networks.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
