CVE-2026-108714: MCP Kotlin SDK Memory Exhaustion DOS Vulnerability

CVE-2026-108714 Overview

CVE-2026-108714 is an uncontrolled resource allocation vulnerability [CWE-770] in the Model Context Protocol (MCP) Kotlin SDK through version 0.15.0. The Application.mcpWebSocket extension installs Ktor WebSockets without configuring a maxFrameSize limit. Remote clients can send small WebSocket frame headers that declare payloads near 2 GiB, forcing the server to pre-allocate huge heap buffers. A handful of connections is sufficient to exhaust server memory and trigger denial of service.

Critical Impact
Unauthenticated remote attackers can crash MCP Kotlin SDK servers by sending oversized WebSocket frame headers, consuming gigabytes of heap memory per connection.

Affected Products

MCP Kotlin SDK versions through 0.15.0
kotlin-sdk-server module exposing Application.mcpWebSocket
Ktor WebSocket transports built on WebSocketMcpTransport

Discovery Timeline

2026-10-11 - CVE-2026-108714 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108714

Vulnerability Analysis

The MCP Kotlin SDK provides WebSocket transport for the Model Context Protocol through the Application.mcpWebSocket extension in WebSocketMcpKtorServerExtensions.kt. When installed, the extension registers Ktor's WebSockets plugin but omits any configuration of maxFrameSize. Ktor therefore defaults to accepting frames up to roughly Int.MAX_VALUE bytes, approximately 2 GiB.

WebSocket servers typically allocate a receive buffer sized to the frame payload length advertised in the frame header before reading the body. The vulnerable code path reads the declared length from an attacker-controlled frame header and asks the JVM to allocate a buffer of that size. A single frame header a few bytes long can request nearly 2 GiB of heap. Multiple parallel connections quickly exhaust available memory, producing OutOfMemoryError and process termination.

Root Cause

The root cause is the missing maxFrameSize constraint during WebSocket plugin installation inside Application.mcpWebSocket. Without an explicit upper bound, the SDK trusts the client-declared frame length without validation, violating secure defaults for resource allocation [CWE-770].

Attack Vector

An unauthenticated remote attacker opens a WebSocket connection to the MCP server endpoint and transmits a WebSocket frame header advertising a payload size near 2 GiB. The attacker does not need to send the full payload. The server allocates the buffer on receipt of the header, consuming heap memory. Repeating this across one or a few connections depletes memory and crashes the process. Refer to the HackMD WebSocket Frame DoS Analysis and the VulnCheck Memory Exhaustion Advisory for the full exploitation chain.

Detection Methods for CVE-2026-108714

Indicators of Compromise

OutOfMemoryError or java.lang.OutOfMemoryError: Java heap space entries in MCP server logs correlated with active WebSocket sessions.
Sudden spikes in JVM heap commit size shortly after new WebSocket connections to the /mcp or custom MCP route.
Repeated short-lived WebSocket connections from the same remote address immediately preceding server crashes.

Detection Strategies

Instrument Ktor WebSocket handlers to log frame.data.size or declared payload length and alert when any value exceeds a sane threshold (for example, 1 MiB).
Monitor JVM metrics for abnormal allocation rates and heap pressure tied to the MCP service.
Inspect network telemetry for WebSocket frames with payload length fields approaching 0x7FFFFFFF.

Monitoring Recommendations

Forward MCP server JVM metrics, Ktor access logs, and crash dumps into a centralized logging pipeline for correlation.
Baseline normal MCP WebSocket message sizes and alert on statistical outliers.
Track process restart counts for MCP services to surface repeated DoS attempts.

How to Mitigate CVE-2026-108714

Immediate Actions Required

Audit all deployments that call Application.mcpWebSocket from the kotlin-sdk-server module and enumerate exposed endpoints.
Restrict network reachability of MCP WebSocket endpoints to trusted clients using firewalls, reverse proxies, or mTLS.
Enforce an explicit maxFrameSize on the Ktor WebSockets plugin for every MCP server deployment until an upstream fix is adopted.

Patch Information

At the time of publication, no fixed release is listed in the NVD entry. Monitor the MCP Kotlin SDK repository for a release beyond 0.15.0 that sets a bounded maxFrameSize. Review the vulnerable code paths in WebSocketMcpTransport.kt and WebSocketMcpKtorServerExtensions.kt when validating any backported fix.

Workarounds

Install the Ktor WebSockets plugin manually before mcpWebSocket with a conservative maxFrameSize, for example 1 MiB, so the SDK reuses the already-configured plugin.
Place MCP services behind a WebSocket-aware reverse proxy that enforces maximum frame and message size, such as Nginx or Envoy.
Apply per-client connection and rate limits to reduce the blast radius of oversized-frame requests.

bash

# Configuration example: enforce a bounded maxFrameSize in Ktor before mcpWebSocket
# Kotlin pseudocode shown as a shell-style snippet for reference
# install(WebSockets) { maxFrameSize = 1_048_576 }  // 1 MiB cap
# routing { mcpWebSocket() }