Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-24 · high
CVE-2026-59279 caps nothing on session memory and needs no login, so a single client can take down a shared server.
Why now: Spring disclosed the flaw and shipped fixed versions on August 20, 2026.
Spring disclosed CVE-2026-59279 on August 20, a flaw in Spring AI's MCP Streamable HTTP transport with a CVSS score of 7.5. A single client, with no login required, can open sessions until the server runs out of memory. That takes down every other session running on it.
Both the WebFlux and WebMvc variants accept unlimited initialize requests and require no client authentication by default, per Spring's advisory. For a server sitting in front of untrusted callers, that's a denial-of-service handed to whoever finds the endpoint first.
There's no workaround. The advisory lists no config flag, no rate limit, no auth toggle to flip as a stopgap. The fix is 2.0.1 for the open-source release and 2.0.0.1 for Enterprise.
This is a resource-exhaustion bug in the protocol handling itself, not in a specific tool or model integration built on top of it. Teams running MCP servers should check the unlimited session count first, then check their version number.
Each link below shares sources, entities, or timing with this story.
Shared entities / Shared topic / Earlier coverage / Tension
Both cover CVE, CVSS; overlapping topics (cvss, disclosed, down); earlier CVE coverage from 2026-02-21.
Shared entities / Shared topic / Earlier coverage
Both cover CVE, CVSS; overlapping topics (august, client, cvss, session); earlier CVE coverage from 2026-08-07.
Shared entities / Shared topic / What happened next
Both cover CVE, CVSS; overlapping topics (august, cvss); picks up the CVE thread on 2026-08-25.
Shared entities / Shared topic / Earlier coverage
Both cover CVE, CVSS; overlapping topics (august, auth); earlier CVE coverage from 2026-08-23.
Both cover CVE, CVSS; overlapping topics (august, cvss); earlier CVE coverage from 2026-08-23.
Both cover CVE, CVSS; overlapping topics (auth, cvss); earlier CVE coverage from 2026-07-28.
Both cover CVE, CVSS; overlapping topics (auth, cvss); earlier CVE coverage from 2026-07-01.
Both cover CVE, CVSS; overlapping topics (client, cvss); earlier CVE coverage from 2026-07-01.