CVE-2026-59279

CVE-2026-59279 is a memory exhaustion vulnerability in Spring AI's MCP (Model Context Protocol) transport where unbounded session accumulation can be triggered without authentication. If you're running Spring AI with the MCP transport, here's what matters: First, check your current configuration. The transport defaults to retaining sessions indefinitely in server-side memory, and authentication is opt-in rather than required. In a production deployment accepting untrusted traffic, this means an attacker can spawn sessions faster than the server can retain them, eventually exhausting available memory. The attack surface is any endpoint exposing the MCP transport to untrusted clients — which includes internal microservices that assume 'internal traffic is trusted' as an operational norm. What to verify right now: (1) Confirm whether your MCP transport binding exposes any network listeners that accept traffic from non-trusted sources, including internal services you don't control. (2) If authentication is currently disabled on the transport, treat that as an exploitable condition regardless of your network posture — the 'internal network is safe' assumption is exactly what turns this from a DOS vector into a lateral movement path. (3) Check your session lifecycle configuration — whether there's an explicit timeout or session limit, and if not, treat the absence as a finding. The deeper risk is the cascade model. Spring AI doesn't ship to end users — it gets embedded into AI gateways and agent orchestration layers running in enterprise environments where service mesh traffic is often implicitly trusted. A single compromised internal service can hammer the MCP transport with session spawns at zero authentication cost. The memory exhaustion then creates backpressure on every agent chain that gateway was serving, making legitimate sessions collateral damage. Finally, consider the documentation layer. The tutorials and quickstarts that shipped with early versions of this library normalized auth-optional configuration. Even after a patch ships, Stack Overflow answers and blog posts written before this CVE will continue teaching the insecure pattern. Your security review should include checking not just your code but the documentation and operational patterns your team adopted from external sources. The fix is straightforward — enable authentication and configure session timeouts — but the vulnerability persists in deployments that never update their libraries or their tutorials.

Reviewed through automated stages and approved by a human before publication.