Executive brief
Spring AI's HTTP server transport for WebFlux and WebMvc lacks session limits and does not require authentication by default. An attacker can repeatedly create sessions without bound, causing the server to consume memory until it crashes, disrupting service for all legitimate users.
Technical details
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) in Spring AI fails to implement session limits and permits unauthenticated access by default. A remote attacker can exploit this by repeatedly initiating new sessions without authentication, causing unbounded accumulation of session state in memory. As sessions persist without expiration or eviction policy, available heap memory is gradually exhausted, triggering out-of-memory conditions and ultimately a denial of service affecting all clients. The vulnerability requires only network reachability to the affected service and no authentication credentials. A patch implementing session limits and authentication requirements is expected from the vendor.
Affected products
- VMware Spring AI 2.0.0
Timeline
- 2026-08-21: published