Denial of Service Risk in Spring AI Due to Unbounded Session Accumulation
CVE-2026-59279

7.5HIGH

Key Information:

Vendor

Spring

Status
Spring Ai
Vendor
CVE Published:
21 August 2026

What is CVE-2026-59279?

The Spring AI framework, particularly in versions 2.0.0, features a vulnerability in its MCP Streamable HTTP server transport for both WebFlux and WebMvc variants. This vulnerability arises from the server's lack of limitations on the number of sessions it can retain, compounded by a default configuration that does not mandate client authentication. As a direct consequence, attackers can initiate an influx of sessions, leading to an unbounded accumulation that consumes system memory over time. This exploitation poses a serious risk of Denial of Service, thereby disrupting service for legitimate users.

Affected Version(s)

Spring AI 2.0.0

References

https://spring.io/security/cve-2026-59279

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.