CVE-2026-53937: the MCP Kotlin SDK exhausts memory on a stdio stream that never sends a newline
NVD·medium signal
NVD published a CVSS 6.2 denial of service in io.modelcontextprotocol:kotlin-sdk versions 0.7.0 through 0.12.0, where the stdio transport grows its buffer without bound while reading bytes that contain no newline delimiter. Fixed in 0.13.0 across the client, core and server artifacts. This is a framing bug in the transport layer rather than a tool-permission bug, which is the less-reported half of the MCP CVE stream.