CVE-2026-55531 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limits sessions through PRAISONAI_MCP_MAX_SESSIONS. This issue is fixed in version 4.6.58.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in PraisonAI versions prior to 4.6.58 represents a critical resource exhaustion flaw within the Model Context Protocol (MCP) HTTP Stream handler, specifically affecting the mcp_post endpoint. As a multi-agent teams system, PraisonAI relies on managing multiple concurrent sessions to coordinate interactions between various AI agents and external tools or data sources. The architectural design of this component involves creating new session entries in an internal dictionary structure every time an initialize request is received from a client. This mechanism is intended to track the state and context of individual agent conversations, ensuring that each interaction remains isolated and coherent for the duration of its lifecycle. However, the implementation lacked essential safeguards to manage these sessions effectively over extended periods or under high load conditions.
The core technical flaw lies in the absence of automatic session cleanup and the lack of a hard limit on the number of concurrent active sessions. When an unauthenticated caller sends an initialize request, the system allocates memory for a new _sessions entry but never invokes the _cleanup_sessions function to remove stale or expired entries. Furthermore, there is no enforcement mechanism based on the PRAISONAI_MCP_MAX_SESSIONS environment variable during this initialization phase. This oversight means that every incoming connection attempt results in a permanent allocation of system resources without any corresponding deallocation logic triggered by timeout or explicit termination commands from the client side. In a production environment where multiple users or automated scripts might interact with the API, this behavior leads to an unbounded growth of memory usage as session objects accumulate indefinitely.
From an operational perspective, this vulnerability allows for a straightforward denial-of-service attack against the PraisonAI infrastructure. An attacker can exploit this flaw by sending a high volume of initialize requests using simple HTTP clients or automated scripts without needing any authentication credentials. Each request consumes RAM to store the new session object, and because these objects are never garbage collected due to the missing cleanup logic, the server's memory footprint increases linearly with each connection attempt. Eventually, the system will exhaust its available physical memory or swap space, leading to severe performance degradation for legitimate users, application crashes, or a complete halt of service availability. This type of attack is particularly dangerous because it requires minimal effort from the attacker and can be executed remotely over the network without any prior access privileges.
This vulnerability aligns with CWE-770: Allocation of Resources Without Limits or Throttling, as the system fails to restrict the consumption of a specific resource (memory) based on defined limits. Additionally, it relates to CWE-400: Uncontrolled Resource Consumption, which describes scenarios where an application consumes resources without proper bounds checking. In terms of offensive security frameworks, this flaw facilitates attacks categorized under MITRE ATT&CK technique T1496: Resource Hijacking, specifically within the context of resource exhaustion leading to denial of service. The lack of authentication for these initialization requests further exacerbates the risk by allowing any external actor on the network path to contribute to the degradation of system stability.
To mitigate this vulnerability and prevent future occurrences, it is imperative that organizations running PraisonAI upgrade immediately to version 4.6.58 or later. This release incorporates the necessary fixes including the invocation of _cleanup_sessions to handle stale session removal and enforces a maximum limit on concurrent sessions via the PRAISONAI_MCP_MAX_SESSIONS configuration parameter. For environments where upgrading is not immediately feasible, temporary mitigations should include placing an authentication gateway in front of the MCP endpoint to restrict access to authorized users only, thereby reducing the attack surface for unauthenticated exploitation. Additionally, implementing rate limiting at the network or reverse proxy level can help throttle excessive connection attempts and provide a buffer against rapid resource exhaustion attacks while permanent patches are applied. Regular monitoring of memory usage trends on servers hosting PraisonAI instances is also recommended to detect any anomalous growth patterns that might indicate ongoing abuse of this vulnerability before it leads to service disruption.