CVE-2026-55531
Received Received - Intake

PraisonAI MCP HTTP Stream Session Exhaustion

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limits sessions through PRAISONAI_MCP_MAX_SESSIONS. This issue is fixed in version 4.6.58.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55531
EUVD
EUVD-2026-65498

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
praisonai praisonai 4.6.58

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PraisonAI's MCP HTTP server allows unauthenticated attackers to cause memory exhaustion by creating an unbounded number of in-memory sessions. The server creates a new session for every initialize request without enforcing session limits or cleanup, leading to continuous memory growth until the process crashes.

Detection Guidance

Monitor memory usage on the PraisonAI server process. Check for continuous growth in memory consumption without corresponding workload increases. Look for excessive session entries in the MCP HTTP Stream handler logs.

Impact Analysis

An attacker could exploit this to exhaust server memory, causing a denial-of-service condition where the system becomes unresponsive or crashes. This disrupts normal operations and may require manual intervention to restore service.

Compliance Impact

This vulnerability could lead to service unavailability, potentially violating availability requirements in GDPR and HIPAA. Downtime may result in non-compliance with data protection and accessibility standards.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.58 or later. Set PRAISONAI_MCP_MAX_SESSIONS to a reasonable limit to prevent unbounded session creation. Ensure the cleanup routine _cleanup_sessions is called periodically.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55531. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart