CVE-2026-59279 in Spring
Summary
by MITRE • 08/21/2026
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over time, gradually exhausting available memory and ultimately causing a Denial of Service that affects all legitimate clients. Affected versions: Spring AI: 2.0.0
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in Spring AI version 2.0.0 pertains to the MCP Streamable HTTP server transport mechanism, which encompasses both WebFlux and WebMvc variants. This component is responsible for managing persistent connections and session states between clients and the server within the context of Model Context Protocol implementations. The core technical flaw lies in the absence of a configured upper bound on the number of active sessions that the server retains in memory. In standard secure configurations, application servers must enforce limits to prevent resource exhaustion attacks, but this implementation fails to implement such constraints by default. Consequently, every new connection initiated by a client results in the allocation and retention of session state data without any mechanism for automatic cleanup or eviction based on volume thresholds.
This architectural oversight creates a direct path for remote attackers to exploit the system through a Denial of Service attack vector. Because the server does not require authentication from connecting clients, an attacker can initiate thousands or even millions of connections using automated scripts or distributed botnets without needing valid credentials. Each connection consumes memory resources as the server allocates structures to track session state. Since there is no limit on retention, these sessions accumulate indefinitely until the Java Virtual Machine heap space is fully exhausted. This leads to OutOfMemoryError conditions that crash the application process or render it unresponsive, effectively denying service to all legitimate users who rely on the AI capabilities provided by Spring AI.
From a classification perspective, this vulnerability aligns with CWE-770: Allocation of Resources Without Limits or Throttling, as the system fails to restrict resource consumption relative to input volume. It also maps to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via application layer flooding. The lack of authentication further exacerbates the risk by removing a critical access control barrier that could otherwise limit exposure to trusted entities only. This combination of unbounded session retention and open access creates a high-severity availability impact where system stability is directly compromised by external actors.
To mitigate this vulnerability, immediate remediation involves upgrading Spring AI to a patched version that implements strict limits on concurrent sessions or connection counts. Administrators should also enforce authentication mechanisms for all incoming requests to the MCP Streamable HTTP endpoints, ensuring that only authorized clients can establish persistent connections. Additionally, implementing rate limiting at the network or application gateway level can help absorb traffic spikes and prevent individual IPs from monopolizing server resources. Monitoring tools should be configured to alert on unusual increases in active session counts, allowing for proactive intervention before memory exhaustion occurs. These measures collectively restore resilience against resource-based denial of service attacks while maintaining the functionality required for legitimate AI interactions.