What is CVE-2026-59279?

CVE-2026-59279 is a high-severity vulnerability in Spring Ai, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-08-21.

How severe is CVE-2026-59279?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Spring Ai

CVE-2026-59279

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over time, gradually exhausting available memory and ultimately causing a Denial of Service that affects all legitimate clients. Affected versions: Spring AI: 2.0.0

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Spring Ai — versions 2.0.0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

security@vmware.com

Frequently asked questions

What is CVE-2026-59279?: CVE-2026-59279 is a high-severity vulnerability in Spring Ai, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2026-08-21.
How severe is CVE-2026-59279?: High severity. CVSS v3 base score is 7.5 out of 10.