Summary
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions (_cleanup_sessions) is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. There is no cap on the number of sessions. Because initialize requires no authentication and the server keeps every session dictionary forever, an attacker who can reach the endpoint (directly when the server is bound to a routable address, or from a victim's browser via the separate Origin-validation bypass) can drive memory usage up without bound until the process is killed by the out-of-memory killer. The same unbounded-growth pattern also applies to the cancelled-requests set populated by notifications/cancelled.
Details
In transports/http_stream.py, each initialize creates and stores a session with no limit:
if body.get("method") == "initialize":
new_session_id = str(uuid.uuid4())
self._sessions[new_session_id] = {
"created_at": time.time(),
"last_activity": time.time(),
}
A cleanup method exists:
def _cleanup_sessions(self) -> None:
now = time.time()
expired = [sid for sid, data in self._sessions.items()
if now - data["last_activity"] > self.session_ttl]
for sid in expired:
del self._sessions[sid]
but grep across the package shows it has no call sites: it is never invoked on a timer, on request handling, or from any background task. self.session_ttl (default 3600) is stored and otherwise unused. There is no maximum-session check anywhere on the write path. As a result self._sessions grows monotonically for the lifetime of the process.
initialize is unauthenticated: in mcp_post the API-key check is skipped when no key is configured (the default), and initialize does not require a prior session. The Origin check is the only gate, and a request with no Origin header is allowed; additionally the Origin allowlist is bypassable (see the companion report on the startswith Origin-validation bypass), so the endpoint is reachable from a malicious web page as well as directly.
The server-side cancellation set in server.py has the same defect:
if method == "notifications/cancelled":
request_id = params.get("requestId")
if request_id:
self._cancelled_requests.add(str(request_id)) # never cleared
self._cancelled_requests is an unbounded set that is added to but never pruned.
PoC
scripts/poc_mcp_session_dos.sh. Start the server (default config, no API key):
praisonai mcp serve --transport http-stream --host 127.0.0.1 --port 8080
Send repeated initialize requests and watch the active session count grow:
for i in $(seq 1 200); do
curl -s -o /dev/null -X POST http://127.0.0.1:8080/mcp \
-H 'Content-Type: application/json' -H 'Origin: http://localhost' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"x","version":"1"}}}'
done
curl -s http://127.0.0.1:8080/health
Observed on 4.6.52 after 200 requests:
{"status":"healthy","server":"praisonai","version":"1.0.0","protocol_version":"2025-11-25","active_sessions":200}
The count rises by one per request and never decreases; there is no TTL expiry and no cap. Sustained requests grow the process resident set without bound. Each session also retains any SSE event history keyed by session id, amplifying the per-session footprint.
Impact
An unauthenticated client can exhaust the memory of the host running the MCP server, leading to denial of service (the process is terminated by the OOM killer, taking down the agent endpoint). When the server is bound to a routable interface (for example --host 0.0.0.0, common in containers), this is a direct remote unauthenticated DoS. With the default localhost bind, it is reachable from any web page the operator visits, because initialize is unauthenticated and the Origin gate is bypassable. The defect is a missing cleanup wiring plus the absence of any session cap, so it manifests even under benign long-running use.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
CVE-2026-55531 has a CVSS score of 6.5 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.6.58); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Enforce the session TTL and cap the number of concurrent sessions: call _cleanup_sessions periodically (a background asyncio task, or opportunistically on each request) and reject new sessions with a 429/503 once a configurable maximum is reached. Bound _cancelled_requests similarly (for example an LRU or a periodic prune keyed by age), since it is also never cleared. Require authentication by default on the HTTP-stream transport so that anonymous clients cannot create sessions at all.
Frequently Asked Questions
- What is CVE-2026-55531? CVE-2026-55531 is a medium-severity uncontrolled resource consumption vulnerability in PraisonAI (pip), affecting versions < 4.6.58. It is fixed in 4.6.58. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is CVE-2026-55531? CVE-2026-55531 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of PraisonAI are affected by CVE-2026-55531? PraisonAI (pip) versions < 4.6.58 is affected.
- Is there a fix for CVE-2026-55531? Yes. CVE-2026-55531 is fixed in 4.6.58. Upgrade to this version or later.
- Is CVE-2026-55531 exploitable, and should I be worried? Whether CVE-2026-55531 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-55531 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-55531? Upgrade
PraisonAIto 4.6.58 or later.