Description

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-11T13:17:14.430Z",
  "pubdate": "2026-10-11T13:17:14.430Z",
  "executiveSummary": "The MCP Kotlin SDK through version 0.15.0 is susceptible to an uncontrolled memory allocation vulnerability within its WebSocket implementation.\nThe flaw stems from the failure of Application.mcpWebSocket to define a maxFrameSize limit when configuring Ktor WebSockets.\nThis vulnerability allows unauthenticated remote attackers to trigger a Denial of Service (DoS) by sending maliciously crafted WebSocket frames.\nBy declaring large payload sizes in frame headers, an attacker can force the server to allocate massive amounts of heap memory, leading to heap exhaustion and application crashes.\nThe vulnerability represents a critical availability risk, as the exploitation process requires minimal resources from the attacker while placing significant strain on the target's memory infrastructure.\nThere are no specific privilege requirements for exploitation, as the vulnerable endpoint is exposed to remote clients via the WebSocket protocol.",
  "technicalDetails": "The root cause of this vulnerability is improper configuration of the Ktor WebSocket engine within the MCP Kotlin SDK. Specifically, the Application.mcpWebSocket function fails to explicitly set a 'maxFrameSize' parameter. In the absence of this constraint, the underlying Ktor framework defaults to allowing frames of significant size, which in this context can reach up to 2 GiB.\nThe attack flow begins when an attacker initiates a WebSocket connection to the vulnerable server. Once the connection is established, the attacker transmits a WebSocket frame with a manipulated header indicating an exceptionally large payload size, approaching the 2 GiB limit. Upon receipt of these headers, the server's memory management system attempts to pre-allocate a buffer sufficient to store the incoming payload according to the specifications provided in the header.\nBecause the server does not validate the frame size against a strict security policy or resource quota, the JVM heap is forced to reserve a contiguous block of memory. An attacker can execute this attack by initiating one or a small number of concurrent connections, sending these crafted headers to rapidly deplete the available heap space. The resulting out-of-memory (OOM) conditions cause the application to become unresponsive or crash, thereby achieving a successful Denial of Service.\nThis vulnerability affects MCP Kotlin SDK versions through 0.15.0. The lack of frame size enforcement creates an unconstrained exposure point that is reachable over standard network protocols. Exploitation does not require prior authentication or elevated privileges, as the WebSocket upgrade process and subsequent frame handling occur before application-level logic is typically applied. The post-exploitation impact is exclusively focused on system availability, resulting in persistent service disruption until the server process is restarted or the memory pressure is relieved.\nTechnical analysis of the Ktor implementation confirms that the default behavior of the WebSocket plugin does not inherently restrict frame sizes to prevent such allocations, placing the responsibility on the implementer to enforce these bounds within the Application.mcpWebSocket initialization block."
}