Executive brief
PraisonAI's MCP HTTP-stream server, which handles agent communication, creates a new session for every client request but never removes expired sessions. An attacker can send repeated requests without authentication to exhaust the server's memory until the process crashes, denying service to all users. This occurs by default with no additional configuration required.
Technical details
The vulnerability is an uncontrolled resource consumption flaw in transports/http_stream.py where each initialize request creates and stores a session in self._sessions with no limit. The _cleanup_sessions() method exists to expire sessions based on TTL (default 3600 seconds) but is never invoked—no background task calls it, no request handler calls it. Additionally, self.session_ttl is stored but otherwise unused. The initialize endpoint requires no authentication (API-key check is skipped when no key is configured, the default). An attacker can reach the endpoint directly when bound to routable addresses or via a browser-based attack exploiting an Origin validation bypass. Each session request adds a dictionary to memory that is never pruned, causing monotonic growth until OOM termination. A secondary issue affects self._cancelled_requests (populated by notifications/cancelled), which is also an unbounded set never cleared. Patch 4.6.58 addresses this.
Affected products
- MervinPraison PraisonAI < 4.6.58
Timeline
- 2026-08-25: disclosed: Published on GitHub Advisory Database
- 2026-06-13: patched: Patched in version 4.6.58 (GitHub-reviewed advisory date)