CVE-2026-59279 Overview
CVE-2026-59279 affects the Spring AI Model Context Protocol (MCP) Streamable HTTP server transport in both WebFlux and WebMvc variants. The transport does not cap the number of sessions retained in memory and does not require client authentication by default. A remote unauthenticated attacker can repeatedly initiate sessions, causing the server to accumulate them until memory is exhausted. The result is a Denial of Service that impacts all legitimate clients of the MCP server. The weakness is classified under CWE-770: Allocation of Resources Without Limits or Throttling.
Critical Impact
Unauthenticated remote attackers can exhaust JVM heap memory on Spring AI MCP servers by creating unlimited sessions, taking the service offline.
Affected Products
- Spring AI 2.0.0
- Spring AI MCP Streamable HTTP server transport (WebFlux variant)
- Spring AI MCP Streamable HTTP server transport (WebMvc variant)
Discovery Timeline
- 2026-08-21 - CVE-2026-59279 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-59279
Vulnerability Analysis
The Spring AI MCP Streamable HTTP server transport maintains an in-memory registry of client sessions. Each incoming session initialization request causes the server to allocate and store session state. The transport applies no upper bound on the number of concurrent or historical sessions retained. It also ships with authentication disabled by default, so any network-reachable client can initiate new sessions freely.
Because session objects are retained in the JVM heap, sustained request volume produces linear memory growth. Once heap capacity is reached, the server experiences frequent garbage collection cycles, request timeouts, and eventually OutOfMemoryError conditions. Legitimate MCP clients lose the ability to connect or complete requests. The condition affects availability only; confidentiality and integrity remain unaffected per the CVSS vector.
Root Cause
The root cause is missing resource governance on session creation. The transport implementation does not enforce a maximum session count, session idle timeout, or per-client session quota. Combined with the absence of default authentication, there is no gating mechanism that limits which clients can consume session slots or how many they can hold.
Attack Vector
An attacker sends repeated HTTP session-initialization requests to the MCP Streamable HTTP endpoint over the network. No credentials, user interaction, or elevated privileges are required. The attacker can script the loop from a single host or distribute it across multiple sources to accelerate memory exhaustion. The vulnerability manifests as a resource exhaustion condition rather than a code-level flaw. Refer to the Spring Security Advisory CVE-2026-59279 for vendor technical details.
Detection Methods for CVE-2026-59279
Indicators of Compromise
- Sustained growth in JVM heap utilization on hosts running Spring AI MCP servers without corresponding increases in legitimate user activity.
- High volume of MCP session-initialization requests from single or clustered source IP addresses.
- Increasing count of active MCP sessions reported by application metrics that does not decay over time.
- Application logs showing OutOfMemoryError or extended garbage collection pauses on MCP transport processes.
Detection Strategies
- Instrument the MCP transport with a session counter metric and alert when the value exceeds a baseline threshold.
- Correlate HTTP access logs against session identifiers to identify clients creating many short-lived or orphaned sessions.
- Baseline expected MCP client counts and alert on deviation, since the transport is typically used by a bounded set of AI clients.
Monitoring Recommendations
- Export JVM heap, garbage collection, and thread metrics to a centralized observability platform.
- Monitor request rates against MCP endpoints and flag sources exceeding normal client behavior.
- Track authentication status on MCP endpoints and alert when unauthenticated requests are accepted in production.
How to Mitigate CVE-2026-59279
Immediate Actions Required
- Upgrade Spring AI beyond version 2.0.0 to a release that includes the fix documented in the Spring Security Advisory.
- Enable authentication on all MCP Streamable HTTP endpoints and reject anonymous session initialization.
- Restrict network access to MCP endpoints so they are only reachable by trusted internal clients.
- Configure a reverse proxy or API gateway to rate-limit session-initialization requests per source.
Patch Information
Refer to the Spring Security Advisory CVE-2026-59279 for the fixed release version, upgrade instructions, and any configuration changes required to enforce session limits and authentication on the MCP Streamable HTTP transport.
Workarounds
- Place the MCP server behind an authenticating reverse proxy that requires mutual TLS or bearer tokens before forwarding requests.
- Deploy a Web Application Firewall rule to rate-limit requests to MCP session-creation endpoints per client IP.
- Configure infrastructure-level connection limits and short idle timeouts on the fronting load balancer.
- Set explicit JVM heap limits and container memory constraints so a memory exhaustion event does not affect co-located services.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
