CVE-2026-53937 - MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
Brief
CVE ID : CVE-2026-53937
Published : Sept. 9, 2026, 12:17 a. m.
- 33 minutes ago
Description : MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.
- 0 through 0.
- 0, `ReadBuffer. append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer. kt` writes every chunk of bytes received from the stdio transport into a `kotlinx. io. Buffer` with no size cap.
Frames are extracted from that buffer only when a `\n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx. coroutines. channels. Channel (Channel.