CVE-2026-59279: Allocation of Resources Without Limits or Throttling in Spring Spring AI
Description
CVE-2026-59279 is a high-severity vulnerability in Spring AI version 2.0.0 where the MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not limit the number of sessions retained and does not require client authentication by default. This allows a remote attacker to cause the server to accumulate an unlimited number of sessions, leading to memory exhaustion and denial of service for legitimate clients.
CVSS v3.1
Score 7.5high
Affected software
Spring
Spring AI
pkg:maven/org.springframework/spring-aiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The MCP Streamable HTTP server transport in Spring AI 2.0.0 lacks limits on session retention and does not enforce client authentication by default. This design flaw enables a remote attacker to create an unbounded number of sessions, which over time exhausts server memory resources and causes a denial of service condition affecting all legitimate users of the service.
Potential Impact
The vulnerability results in denial of service by exhausting server memory through unbounded session accumulation. There is no impact on confidentiality or integrity, but availability is severely affected, disrupting service for legitimate clients.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing manual session limits or authentication requirements to mitigate unbounded session creation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- vmware
- Date Reserved
- 2026-07-04T18:13:26.297Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a884318acd9273b491e8756
Added to database: 08/21/2026, 12:22:48 UTC
Last enriched: 09/10/2026, 18:24:18 UTC
Last updated: 10/05/2026, 06:48:17 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.