Executive brief
The MCP Kotlin SDK, used to implement the Model Context Protocol in Kotlin applications, contains a memory exhaustion vulnerability in its stdio transport layer. An attacker who can send bytes to the SDK server without including newline characters can cause the internal read buffer to grow indefinitely, consuming all available memory and crashing the process. This is especially dangerous in architectures where the SDK server is spawned as a subprocess by a host application that pipes untrusted network data to it.
Technical details
The vulnerability exists in the `ReadBuffer.append()` method in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt`, which writes incoming byte chunks into a `kotlinx.io.Buffer` with no maximum size limit. The buffer only extracts complete frames when a newline (0x0a) is encountered; until then, all received bytes accumulate. An attacker can exploit this by sending a continuous stream of data without newlines through the stdio transport, causing unbounded memory allocation. The vulnerability is amplified by `StdioServerTransport` and `StdioClientTransport`, which queue raw chunks through an unbounded coroutine Channel before appending them to the buffer. This is a pre-authentication remote denial of service triggered whenever the SDK server's stdin receives attacker-controlled or untrusted input. Version 0.13.0 addresses this by adding buffer size limits and backpressure mechanisms.
Affected products
- Model Context Protocol Kotlin SDK 0.7.0 through 0.12.0
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Version 0.13.0 fixes the issue