Description

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over time, gradually exhausting available memory and ultimately causing a Denial of Service that affects all legitimate clients. Affected versions: Spring AI: 2.0.0

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T12:16:30.013Z",
  "pubdate": "2026-08-21T12:16:30.013Z",
  "executiveSummary": "The identified vulnerability involves a resource management flaw within the MCP Streamable HTTP server transport implementations for both WebFlux and WebMvc variants in Spring AI. Specifically, the affected server components fail to enforce any upper bound or threshold on the total number of concurrently retained sessions. Furthermore, the default configuration lacks mandatory client authentication mechanisms, exposing the endpoint to unauthenticated network access.\nThe primary impact of this architectural deficiency is a remote Denial of Service condition. By continuously initiating new sessions without termination constraints, an unauthenticated remote attacker can exhaust the heap memory resources of the host server over time. This gradual exhaustion leads to severe performance degradation and ultimately complete application crashes, affecting all concurrent legitimate clients attempting to utilize the service.\nThe vulnerability affects Spring AI version 2.0.0. Exploitation requires network access to the exposed MCP Streamable HTTP server transport endpoints. Given the default lack of authentication and session limits, minimal attacker capabilities are required to systematically trigger memory exhaustion.",
  "technicalDetails": "The vulnerability resides in the MCP Streamable HTTP server transport implementations, encompassing both WebFlux and WebMvc variants within Spring AI 2.0.0. The root cause is twofold: the absence of a configured maximum retention limit for active server sessions and the default configuration omitting mandatory client authentication.\nFrom an architectural standpoint, when clients establish communication with the MCP Streamable HTTP server transport, the application allocates internal data structures to track and maintain the state of each session. Because the implementation does not prune stale sessions, enforce time-to-live expiration policies, or restrict the cumulative count of simultaneous sessions, every incoming connection request forces the continuous accumulation of state data in memory.\nThe attack flow proceeds as follows: First, a remote attacker identifies the network-exposed MCP Streamable HTTP server transport endpoints. Due to the default lack of authentication requirements, the attacker requires no valid credentials or prior system privileges to interact with the service. Second, the attacker initiates a high volume of HTTP requests designed to trigger session creation. Third, the server processes these requests and allocates memory resources to retain the newly generated sessions indefinitely. Because no cleanup mechanism or threshold bounds exist, these sessions persist within the runtime environment.\nAs the attacker sustains this session creation payload over time, the server memory consumption scales linearly until it breaches available heap limits. This resource starvation event induces garbage collection thrashing, memory allocation failures, and eventual application crashes. The resulting Denial of Service impacts the availability of the server for all authenticated and unauthenticated legitimate users alike."
}