Is CVE-2026-108714 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108714 being exploited in the wild.

How severe is CVE-2026-108714?

High severity, with a CVSS score of 7.5, published 11 October 2026.

Which products and versions are affected?

Anthropic MCP Kotlin SDK through 0.15.0.

Is there a fix for CVE-2026-108714?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108714 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108714?

Check whether you run Anthropic MCP Kotlin SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108714: MCP Kotlin SDK uncontrolled memory allocation in WebSocket

CVE-2026-108714 · Severity: high · CVSS 7.5 · Published 2026-10-11

The MCP Kotlin SDK is a framework for building Model Context Protocol servers and clients in Kotlin. A vulnerability in the WebSocket transport allows remote attackers to send specially crafted frame headers declaring gigabyte-scale payloads, forcing the server to allocate massive amounts of heap memory and crash, resulting in a denial of service.

Vendors: Anthropic.

Quick answers

Is CVE-2026-108714 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108714 being exploited in the wild.
How severe is CVE-2026-108714?: High severity, with a CVSS score of 7.5, published 11 October 2026.
Which products and versions are affected?: Anthropic MCP Kotlin SDK through 0.15.0.
Is there a fix for CVE-2026-108714?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108714 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108714?: Check whether you run Anthropic MCP Kotlin SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WebSocketMcpTransport class in MCP Kotlin SDK through 0.15.0 fails to configure a maxFrameSize limit on Ktor WebSocket sessions, allowing attackers to declare frame payloads near 2 GiB. An unauthenticated remote attacker can send small frame headers with inflated payload size declarations over one or a few network connections, triggering unbounded heap allocations that exhaust server memory and cause denial of service.

Affected products

Anthropic MCP Kotlin SDK through 0.15.0

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.