Spray—PraisonAI’s MCP HTTP Stream endpoint creates a new session object for each initialize request sent to the _sessions data structure. The code fails to trigger a cleanup routine or enforce a maximum session count. An unauthenticated caller therefore can submit numerous initialize requests, causing the session list to grow without bound and consuming the system’s memory resources. The unchecked memory usage can lead to process termination or severe slowdown, effectively denying service to legitimate users. This flaw aligns with CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Memory Leak).

The vulnerability exists in all releases of PraisonAI prior to version 4.6.58. Any deployment running 4.6.57 or earlier is susceptible. The fix is implemented in release 4.6.58 and later. The affected vendor is MervinPraison, product PraisonAI.

The CVSS score of 6.5 indicates medium severity, with no exploitation proof of concept reported yet. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated attacker sending repeated initialize requests to the MCP endpoint. Because the vulnerability does not require authentication and operates over an HTTP interface, it can be triggered remotely from any network segment that can reach the server. The risk of denial of service is real if the attacker can sustain a high volume of initialize requests without rate limiting. The impact is limited to availability, but it can also affect overall system performance for all users.