Spring AI discloses unbounded session retention in its MCP Streamable HTTP transport, fixed in 2.0.1

Spring published CVE-2026-59279 on 2026-08-21: the MCP Streamable HTTP server transport in Spring AI 2.0.0, in both its WebFlux and WebMvc variants, places no limit on the number of sessions it retains and does not require clients to authenticate by default. A remote attacker can open sessions until the server exhausts memory, a denial of service NVD scores at CVSS 7.5. The fix is Spring AI 2.0.1 (2.0.0.1 on the enterprise-support line), with no workaround listed. Spring credits the find to internal discovery.

It is the third resource-exhaustion disclosure to land in the Java MCP ecosystem in three days. The official Java SDK published two CWE-770 advisories on 2026-08-19 - unbounded HTTP request-body reads on the server side and unbounded SSE buffering on the client side - and shipped caps across three release lines the same afternoon. Spring AI maintains its own MCP integration on top of the Spring stack, and the Java SDK's 2.0.1 release notes record Spring AI conformance at 2.0.0 GA, placing both projects in the same release wave. The unbounded-session defect is distinct from both SDK issues: it exhausts memory through protocol sessions rather than through request or event payloads.