{
 "id": "AIR-2026-1351",
 "slug": "mcp-kotlin-sdk-vulnerable-to-buffer-growth-denial-of-service",
 "title": "MCP Kotlin SDK vulnerable to buffer growth denial of service",
 "summary": "The Model Context Protocol Kotlin SDK fails to cap read buffers from stdio transport when newlines are omitted. This allows peers to exhaust JVM memory and crash the host process.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "MCP Kotlin SDK"
 ],
 "incident_date": "2026-09-09",
 "incident_date_precision": "day",
 "first_reported": "2026-09-09",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53937",
   "publisher": "NVD",
   "title": "CVE-2026-53937: MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol.",
   "published_at": "2026-09-09"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-53937",
  "mcp",
  "memory-exhaustion"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}