{"id":19815,"date":"2026-09-09T08:31:26","date_gmt":"2026-09-09T00:31:26","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53937"},"modified":"2026-09-09T08:31:26","modified_gmt":"2026-09-09T00:31:26","slug":"cve-2026-53937","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53937","title":{"rendered":"CVE-2026-53937 [MEDIUM] &#8211; MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context"},"content":{"rendered":"<p>MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core\/src\/commonMain\/kotlin\/io\/modelcontextprotocol\/kotlin\/sdk\/shared\/ReadBuffer.kt` writes every chunk of bytes received from the stdio transport into a `kotlinx.io.Buffer` with no size cap. Frames are extracted from that buffer only when a `n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx.coroutines.channels.Channel(Channel.UNLIMITED)` and then call `readBuffer.append(chunk)` without backpressure or size guard. This is a remote-pre-auth denial of service whenever an SDK stdio server&#8217;s stdin is fed by an untrusted or attacker-controlled producer (for example: a host program that exec&#8217;s the MCP server as a subprocess and pipes through bytes received from a network peer, or a sidecar wrapper that proxies bytes from an HTTP endpoint to the stdio transport). Version 0.13.0 fixes the issue.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core\/src\/commonMain\/kotlin\/io\/m<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-19815","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/19815","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19815"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19815"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19815"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}