Spring AI CVE-2026-59279: Unbounded MCP Sessions Exhaust Memory
Spring AI 2.0.0 retains unlimited Streamable HTTP MCP sessions without authentication by default. Analyse DoS exposure, upgrades and resource budgets.
- AUTHOR
- Karol Rapacz / CEO Breachroad · OSCP · PNPT
- PUBLISHED
- 21 August 2026
- READING TIME
- 17 min read
- TOPIC
- AI Security
CVE-2026-59279 entered public vulnerability databases on 21 August after Spring published its notice one day earlier. It affects Spring AI 2.0.0 and the MCP Streamable HTTP server transport in both WebFlux and WebMvc variants. The implementation retains sessions without a limit, and clients do not require authentication by default. A remote attacker can repeatedly initialise sessions, gradually consume memory and deny service to every legitimate agent.
This is a CVSS 7.5 availability issue. The source does not support claims of prompt disclosure, tool execution or server takeover. A denial of service at the MCP layer can still stop an agent-dependent business process and bury other activity beneath restarts and recovery noise.
The exact trust boundary
MCP Streamable HTTP lets a client send initialize, receive a session identifier and continue over HTTP. The server retains state to associate later requests with client capabilities, transport and lifecycle. If every initialisation creates persistent state without a cap, TTL or mandatory identity, an anonymous client can produce sessions faster than the server can remove them.
WebFlux and WebMvc use different execution models, but the advisory covers both. A reactive stack does not fix an unbounded semantic resource: the session map still grows. Autoscaling does not remove the flaw either. It may increase cost as hostile traffic creates more instances and repeats allocation.
Affected and fixed releases
Spring identifies Spring AI 2.0.0 as affected. The public OSS fix is in 2.0.1. Enterprise Support customers can use 2.0.0.1. Spring says that upgrading to the corresponding fixed version requires no further mitigation for this CVE.
Operators should still verify the effective dependency in the built artifact. Spring Boot BOMs, dependency management and Gradle or Maven caches can make source declarations differ from the final JAR. Search internal starter modules that may bundle or copy transport configuration.
Why a reverse proxy is not enough
Edge rate limiting can reduce session-creation speed but does not expire records already created. If a policy permits a thousand initialisations per day while state never ages out, memory still grows. Request-body limits are also irrelevant because initialize need not be large. A WAF may recognise an endpoint, but it cannot reliably distinguish a semantically valid initialisation from a legitimate client without identity and a resource budget.
The fixed release is the primary control. A sound architecture also authenticates before durable state allocation, enforces active-session limits per principal and globally, applies idle and absolute lifetime, and removes state atomically after errors or closure.
Assessing exposure
Determine whether the application runs the MCP server transport rather than only a Spring AI client. A dependency alone does not prove endpoint reachability. Inspect WebMvc or WebFlux routes, reverse proxies, ingress, security chains and network policy. A loopback-only service has a different threat surface than a public load balancer, although an untrusted local process on a shared host may still reach it.
Collect session-created and session-active counts, initialize rate, sessions per source or principal, last-activity time, heap occupancy, GC pauses, restarts and endpoint health. If the application lacks session-count telemetry, add it after the upgrade as an operational control.
A safe rollout
Use staging with the same Spring Boot, proxy and authorisation configuration. Upgrade to 2.0.1 or the supported Enterprise build, create a fresh artifact and verify its SBOM. Test MCP clients across initialisation, reconnect, close, timeout, multiple valid sessions and network interruption.
A negative test should prove resource limits and memory recovery without recreating a large denial of service in production. A small, controlled sequence of abandoned initialisations is enough to observe heap and session count in an isolated environment. Compare GC, latency and client errors during canary deployment.
If the update must wait, place the endpoint behind an authenticated gateway, restrict network sources and rate-limit initialize aggressively. A memory-threshold restart may restore availability temporarily but destroys legitimate sessions and is not a permanent mitigation. Merely increasing heap extends time to failure and increases recovery cost.
Hunting an availability incident
Look for growth in new session IDs without corresponding tool traffic, repeated initialisations that never continue, steadily rising heap and full GC cycles that do not release memory. One source IP may represent NAT or a proxy. Trust X-Forwarded-For only when it was set by a controlled ingress that strips client-supplied copies.
A heap dump can confirm session objects dominate memory, but it may contain sensitive data. Protect it as incident evidence. Restart logs, OOMKill events, pod history and load-balancer 5xx responses establish a timeline. High session creation alone does not prove malicious intent; a defective client with aggressive reconnect logic can produce the same symptom.
After upgrading, consider a controlled restart to remove state accumulated by an old process. Notify agent owners about reconnection. Do not rotate tokens or secrets without evidence because the CVE describes availability, not disclosure.
MCP is a public API, not merely a local plug-in
MCP components originally used locally are increasingly deployed in clusters and behind load balancers. Treat every server as an API: authenticate, authorise per tool, enforce resource budgets, validate schemas, restrict egress, retain audit logs and support revocation.
Session lifecycle is part of security. Allocating state before authentication, omitting TTL and lacking a per-tenant cap are independent architectural warning signs even after this specific patch. Load and chaos tests should include a client that never closes sessions, reconnects repeatedly and disappears halfway through initialisation.
Set budgets from measured concurrent agents, restart bursts, memory per session and expected reconnect time. Alert well before the hard cap, and return a controlled retry response so clients can apply exponential backoff with jitter instead of creating a reconnect storm.
Vendor facts and Breachroad conclusions
Spring AI 2.0.0 scope, WebFlux and WebMvc applicability, missing limit, default lack of authentication, CVSS and fixed versions 2.0.1 and 2.0.0.1 come from the official advisory. Spring says the issue was found internally and does not report exploitation.
Per-principal budgets, telemetry, canary deployment, hunting and the public-API model are Breachroad conclusions. AI security training helps engineering and SOC teams align on these boundaries, while an AI security assessment can validate transport, authentication, lifecycle, tools and egress.
