RMCP Streamable HTTP Server Session Leak Denial of Service

Technical Analysis

The entry point is StreamableHttpService::handle_post, which calls LocalSessionManager.create_session before verifying that the incoming JSON-RPC message is a valid initialization request with matching protocol headers. When validation fails after session creation, the code returns early without removing the just-inserted LocalSessionHandle from the shared sessions table, leaking session and channel state. Because no authentication is required to reach this code path, an attacker can send an unbounded stream of malformed POST requests to continuously grow the session table, causing lock contention that degrades latency for legitimate clients and eventually exhausts server memory, terminating the process. This is a protocol/transport-layer availability issue affecting any agent or client relying on the rmcp Streamable HTTP server for MCP communication, rather than a data confidentiality or integrity compromise.

Affected Systems

rmcp (Rust SDK for Model Context Protocol); protocols: MCP

Detection Signatures

• Rapid, sustained growth in LocalSessionManager.sessions table size over time
• High volume of JSON-RPC POST requests to the Streamable HTTP endpoint that are not valid initialization requests
• Requests with mismatched or missing MCP protocol version headers
• Increasing memory usage and rising request latency correlated with unauthenticated POST traffic
• Repeated session creation without corresponding termination events in server logs

Remediation Steps

1. 1

   Upgrade rmcp

   Update the rmcp crate to version 2.0.0 or later, which fixes the session cleanup logic on validation failure.

2. 2

   Validate before session creation

   If running a custom or patched transport, ensure message validation (initialization check, protocol header match) occurs before any session state is allocated.

3. 3

   Rate limit and authenticate

   Apply rate limiting, connection throttling, and require authentication or network-level access controls on the Streamable HTTP endpoint to reduce exposure to unauthenticated abuse.

4. 4

   Monitor session table growth

   Add alerting on unbounded growth of in-memory session tables and enforce maximum session limits with eviction of stale/invalid entries.