Advisories · Technology

io.modelcontextprotocol:kotlin-sdk.

Every CVE that names io.modelcontextprotocol:kotlin-sdk among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-53937 CVE record

CVSS 6.2 Medium

MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
- io.modelcontextprotocol:kotlin-sdk
- io.modelcontextprotocol:kotlin-sdk-client
- Denial of service
Not analysed yet 8 Sept 2026