EUVD-2026-63931
GHSA-2g9x-r8w8-qjff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed MCP HTTP endpoint
-
DeliveryIssue repeated unauthenticated session-init requests
-
ExploitServer allocates unbounded session objects
-
ExecutionJVM heap progressively exhausted
-
PersistServer crashes or becomes unresponsive
-
ImpactLegitimate clients denied service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Spring AI application must be running version 2.0.0 with the MCP Streamable HTTP server transport enabled - either the WebFlux or WebMvc variant. The default configuration with no client authentication is required; operators who have already added Spring Security authentication in front of the MCP endpoint are not exploitable via this vector. The attacker must have network connectivity to the HTTP port hosting the MCP transport. Exploitation is limited to Availability impact only - Confidentiality and Integrity are unaffected. There is no requirement for any special tool or pre-existing session; standard HTTP clients suffice. |
| Impact | The CVSS 7.5 High score is well-calibrated for this vulnerability: AV:N/AC:L/PR:N/UI:N reflects that exploitation requires nothing beyond network connectivity and the ability to issue HTTP requests. The Availability:High rating is appropriate because memory exhaustion crashes or renders the entire server unresponsive. Real-world risk is heavily gated by exposure: Spring AI's MCP HTTP endpoint is typically deployed in internal AI-assistant or developer tooling environments rather than internet-facing production services, which meaningfully reduces the attack surface compared to the raw CVSS score implies. No EPSS data was provided in the source intelligence, and no CISA KEV listing exists, suggesting exploitation has not been observed in the wild at time of analysis. For organizations where the MCP endpoint is internet-reachable or accessible from untrusted network segments, the operational risk is high given the trivial attack complexity. |
| Exploit ScenarioDerived | An attacker identifies an internet-exposed or intranet-reachable Spring AI MCP Streamable HTTP endpoint running version 2.0.0. Without providing any credentials, the attacker runs a script that continuously issues HTTP requests to the endpoint's session-initiation path, causing the server to allocate and retain a new session object for each request. As the heap fills over minutes to hours (depending on available memory and request rate), the JVM garbage collector becomes unable to reclaim the orphaned session objects, eventually triggering out-of-memory errors that crash the server or cause severe degradation for all legitimate AI application users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 21, 2026
Unbounded session accumulation in Spring AI 2.0.0's MCP Streamable HTTP server transport enables remote unauthenticated attackers to exhaust server memory, ultimately causing a Denial of Service that disrupts all legitimate clients. Both WebFlux and WebMvc transport variants are affected because neither enforces a session cap nor mandates client authentication by default. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects trivially simple exploitation from any network with access to the MCP endpoint.
RemediationAI
No vendor-released patched version was identified in the available data at time of analysis; refer to the Spring Security advisory at https://spring.io/security/cve-2026-59279 for the latest patch availability and recommended upgrade version. As a compensating control, operators should enforce authentication on the MCP HTTP endpoint immediately - Spring Security can be configured to require a valid bearer token or client certificate before session state is allocated, directly neutralizing the unauthenticated exploitation path. Additionally, placing a reverse proxy (e.g., nginx, HAProxy) in front of the MCP endpoint with connection-rate limiting and maximum concurrent session rules can throttle an attacker's ability to exhaust memory. If the MCP endpoint does not need to be network-accessible, binding it to localhost or a private VLAN substantially reduces exposure. Each workaround trades off developer convenience or deployment flexibility for attack surface reduction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spring AI is VMware/Broadcom's framework for integrating AI model capabilities into Spring-based Java applications. The affected component implements the Model Context Protocol (MCP) over HTTP, offering two transport variants: WebFlux (reactive, non-blocking) and WebMvc (servlet-based). Both variants maintain server-side session state for connected MCP clients but, in the 2.0.0 release, impose no upper bound on concurrent or accumulated sessions (CWE-770: Allocation of Resources Without Limits or Throttling). Because the default configuration also omits client authentication, any remote actor can create new sessions without restriction. Over time, heap memory fills with orphaned session objects - a classic slow-loris-style resource exhaustion pattern applied to session state rather than connections.
Know when Spring Ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no authentication or complexity barrier; impact is Availability-only, as session accumulation causes DoS with no confidentiality or integrity exposure.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
DescriptionCVE.org
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over time, gradually exhausting available memory and ultimately causing a Denial of Service that affects all legitimate clients. Affected versions: Spring AI: 2.0.0
Executive ViewAI
Spring AI 2.0.0's MCP server transport contains an unauthenticated remote memory exhaustion vulnerability that allows attackers without credentials to crash the application and deny service to all legitimate users. Organizations running this version with network-accessible MCP endpoints face immediate risk to application availability and operational continuity.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce network segmentation and firewall rules restricting MCP endpoint access by IP whitelist; deploy reverse proxy with aggressive rate-limiting, connection caps, and timeout enforcement; implement continuous monitoring and alerting on session counts, memory utilization, and connection rate anomalies; prepare runbook procedures to rapidly disable MCP endpoints upon detection of resource exhaustion. These controls substantially reduce but do not eliminate attack surface; immediate patching is required when vendor releases a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Incorrect authorization in Spring AI's tool-calling layer allows a tool that was never advertised to the current request
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
SQL injection in Spring AI's CosmosDBVectorStore component (versions 1.0.0-1.0.5 and 1.1.0-1.1.4) enables authenticated
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter component allows authenticated at
Spring AI's AbstractFilterExpressionConverter fails to properly escape user-controlled input in JSONPath queries, allowi
Filter expression injection in Spring AI 1.0.0-1.0.5 and 1.1.0-1.1.4 allows remote unauthenticated attackers to manipula
Server-Side Request Forgery in Spring AI Bedrock Converse module enables unauthenticated remote attackers to force the a
Filter-expression injection in Spring AI's MilvusVectorStore allows remote unauthenticated attackers to manipulate vecto
Conversation memory poisoning in VMware Spring AI allows remote unauthenticated attackers to inject malicious input that
Query injection in the Spring AI vector-store modules - spring-ai-elasticsearch-store, spring-ai-opensearch-store and sp
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a
Predictable ONNX model cache path creation in Spring AI enables a local attacker on a shared multi-user host to pre-crea
Exploit-DB