CVE-2026-59279 Unbounded persistent session allocation via repeated initialize requests
Remote attackers can exhaust server memory by creating unlimited sessions, causing denial of service in Spring AI applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59279?
CVE-2026-59279 is a high-severity denial of service vulnerability in Spring AI, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over time, gradually exhausting available memory and ultimately causing a Denial of Service that affects all legitimate clients. Affected versions: Spring AI: 2.0.0
Weakness: CWE-770
Which versions are affected by CVE-2026-59279?
It affects 1 product.
Products include Vmware Spring Ai.
How do I fix CVE-2026-59279?
No fix has been published for CVE-2026-59279 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59279 being exploited?
There is no known exploitation of CVE-2026-59279 in the wild and no public exploit code.
Other vulnerabilities in Spring AI
- CVE-2026-22738 SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
- CVE-2026-40978 Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()
- CVE-2026-22730 CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter
- CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
- CVE-2026-41705 Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs
Sources
Also known as GHSA-2g9x-r8w8-qjff.