Spring AI MCP Streamable HTTP Server Unbounded Session Accumulation DoS
First seen Aug 21, 2026 · Updated Aug 21, 2026 · CVSS 7.5
Spring AI's MCP Streamable HTTP server transport (WebFlux/WebMvc) fails to limit or authenticate sessions, allowing a remote unauthenticated attacker to open unbounded sessions until the server exhausts memory and crashes. This is a straightforward denial-of-service issue rather than an agent-logic compromise, but it can take down MCP-based agent infrastructure for all legitimate clients.
Technical Analysis
The MCP Streamable HTTP transport creates and retains a server-side session for each incoming client connection without enforcing authentication or an upper bound on concurrent/retained sessions. An attacker can repeatedly initiate new sessions (e.g., via scripted HTTP requests to the MCP endpoint) causing the session store to grow unbounded over time. This gradually exhausts heap/memory resources on the host, degrading and eventually crashing the MCP server process, denying service to all legitimate agent clients relying on that server. The entry point is the exposed MCP HTTP endpoint itself; no valid credentials or prior trust relationship are required, making this exploitable by any network-reachable attacker against default configurations.
Affected Systems
Spring AI; protocols: MCP
Detection Signatures
- Sustained increase in active/retained MCP session count without corresponding client activity or teardown
- Repeated session-initiation requests from single or small set of IPs to /mcp or Streamable HTTP endpoint with no follow-up traffic
- Growing JVM heap usage / memory pressure correlated with MCP server session table growth
- Absence of authentication headers/tokens on MCP session establishment requests
- Application logs showing session creation without matching disconnect/expiry events over extended periods
Remediation Steps
- 1
Upgrade Spring AI
Apply the vendor patch/upgrade for Spring AI that introduces session limits and expiration for the MCP Streamable HTTP transport as soon as it is available.
- 2
Require authentication on MCP endpoints
Enforce authentication (e.g., mutual TLS, API keys, OAuth) for all MCP Streamable HTTP connections rather than relying on default open access.
- 3
Impose session caps and timeouts
Configure maximum concurrent session limits and idle/absolute session timeouts at the application or reverse proxy layer to prevent unbounded accumulation.
- 4
Rate limit and monitor connections
Deploy rate limiting, connection throttling, and WAF/reverse-proxy protections in front of the MCP server, and monitor session counts and memory usage for anomalies.
- 5
Network segmentation
Restrict MCP server exposure to trusted networks or VPNs where possible instead of leaving it publicly reachable.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.