The vulnerability occurs when the MCP Streamable HTTP server transport, used by Spring AI’s WebFlux and WebMvc variants, allocates a new persistent session for each initialize request without imposing any upper bound. This lack of limit allows an attacker to generate an unbounded number of sessions, causing the server’s memory footprint to grow progressively. Over time the server exhausts available memory, leading to a denial of service for all legitimate clients. The weakness corresponds to CWE-770, uncontrolled resource consumption.

Spring AI 2.0.0, specifically the WebFlux and WebMvc implementations of the HTTP server transport. Clients interacting with these endpoints without authentication are affected.

The CVSS score of 7.5 indicates a high severity of the Denial of Service impact. The EPSS score is not available, making it difficult to gauge current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is remote: an adversary can repeatedly issue initialize requests from an external system to trigger session allocation. No authentication requirement by default further lowers the barrier to exploitation, enabling attacks from unauthenticated users. The attacker must maintain persistent traffic to induce memory exhaustion, but once the limit is reached, the service becomes unavailable to all users.