CVE-2026-55531: PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

In transports/http_stream.py, each initialize call adds an entry to self._sessions under a fresh UUID. A cleanup method, _cleanup_sessions, exists, but nothing in the package calls it. The session_ttl setting (default 3600) is stored and never used, and there is no cap on the session count. The dictionary therefore only grows while the process lives. Each session can also hold SSE event history, which adds to the footprint. In server.py, the set _cancelled_requests, filled by notifications/cancelled, is also never pruned.

initialize needs no authentication when no API key is set, which is the default, and needs no earlier session. The only gate is the Origin check, and requests with no Origin header pass it.

With --host 0.0.0.0, common in containers, any network client can run the attack directly. With the default localhost bind, a web page the operator visits can do it through the companion Origin bypass. The proof of concept sent 200 initialize requests and /health reported active_sessions: 200, with no decrease afterwards. The result is that the MCP endpoint, and anything else in the same process, goes down. The flaw also shows up in long benign runs, since expiry never happens.

PraisonAI on PyPI below 4.6.58 (observed on 4.6.52), when the MCP HTTP Stream transport is running. Servers bound to a routable address with no API key are the exposed case. Localhost-only servers are exposed through a browser.

Check the version, and watch the session count on a running server:

pip show PraisonAI
curl -s http://127.0.0.1:8080/health

The /health response has an active_sessions field. A number that only goes up is the symptom.

Upgrade to 4.6.58:

pip install --upgrade "PraisonAI>=4.6.58"

The linked commit and release page did not let me confirm how session expiry was changed, so check active_sessions on /health after sending a few initialize requests and waiting past the TTL.

Stopgaps: bind to 127.0.0.1 rather than 0.0.0.0, start the server with --api-key, put it behind a reverse proxy that rate-limits /mcp, and set a memory limit on the container or service so a runaway process restarts cleanly. The reporter suggests a periodic cleanup task and a session cap that returns 429 or 503.

Watch the active_sessions value from /health and the process's resident memory. A steady climb with no matching real clients points to this. In access logs, look for many POST /mcp requests with "method":"initialize" from one address, or from a browser with an unusual Origin.

After an incident, check kernel logs for OOM kills of the Python process (dmesg | grep -i oom) and for container restarts. A server that restarts every few hours with no clear cause deserves a look at the same signals.

Summary

The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions (_cleanup_sessions) is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. There is no cap on the number of sessions. Because initialize requires no authentication and the server keeps every session dictionary forever, an attacker who can reach the endpoint (directly when the server is bound to a routable address, or from a victim's browser via the separate Origin-validation bypass) can drive memory usage up without bound until the process is killed by the out-of-memory killer. The same unbounded-growth pattern also applies to the cancelled-requests set populated by notifications/cancelled.

Details

In transports/http_stream.py, each initialize creates and stores a session with no limit:

if body.get("method") == "initialize":
    new_session_id = str(uuid.uuid4())
    self._sessions[new_session_id] = {
        "created_at": time.time(),
        "last_activity": time.time(),
    }

A cleanup method exists:

def _cleanup_sessions(self) -> None:
    now = time.time()
    expired = [sid for sid, data in self._sessions.items()
               if now - data["last_activity"] > self.session_ttl]
    for sid in expired:
        del self._sessions[sid]

but grep across the package shows it has no call sites: it is never invoked on a timer, on request handling, or from any background task. self.session_ttl (default 3600) is stored and otherwise unused. There is no maximum-session check anywhere on the write path. As a result self._sessions grows monotonically for the lifetime of the process.

initialize is unauthenticated: in mcp_post the API-key check is skipped when no key is configured (the default), and initialize does not require a prior session. The Origin check is the only gate, and a request with no Origin header is allowed; additionally the Origin allowlist is bypassable (see the companion report on the startswith Origin-validation bypass), so the endpoint is reachable from a malicious web page as well as directly.

The server-side cancellation set in server.py has the same defect:

if method == "notifications/cancelled":
    request_id = params.get("requestId")
    if request_id:
        self._cancelled_requests.add(str(request_id))   # never cleared

self._cancelled_requests is an unbounded set that is added to but never pruned.

PoC

scripts/poc_mcp_session_dos.sh. Start the server (default config, no API key):

praisonai mcp serve --transport http-stream --host 127.0.0.1 --port 8080

Send repeated initialize requests and watch the active session count grow:

for i in $(seq 1 200); do
  curl -s -o /dev/null -X POST http://127.0.0.1:8080/mcp \
    -H 'Content-Type: application/json' -H 'Origin: http://localhost' \
    -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"x","version":"1"}}}'
done
curl -s http://127.0.0.1:8080/health

Observed on 4.6.52 after 200 requests:

{"status":"healthy","server":"praisonai","version":"1.0.0","protocol_version":"2025-11-25","active_sessions":200}

The count rises by one per request and never decreases; there is no TTL expiry and no cap. Sustained requests grow the process resident set without bound. Each session also retains any SSE event history keyed by session id, amplifying the per-session footprint.

Impact

An unauthenticated client can exhaust the memory of the host running the MCP server, leading to denial of service (the process is terminated by the OOM killer, taking down the agent endpoint). When the server is bound to a routable interface (for example --host 0.0.0.0, common in containers), this is a direct remote unauthenticated DoS. With the default localhost bind, it is reachable from any web page the operator visits, because initialize is unauthenticated and the Origin gate is bypassable. The defect is a missing cleanup wiring plus the absence of any session cap, so it manifests even under benign long-running use.

Remediation

Enforce the session TTL and cap the number of concurrent sessions: call _cleanup_sessions periodically (a background asyncio task, or opportunistically on each request) and reject new sessions with a 429/503 once a configurable maximum is reached. Bound _cancelled_requests similarly (for example an LRU or a periodic prune keyed by age), since it is also never cleared. Require authentication by default on the HTTP-stream transport so that anonymous clients cannot create sessions at all.