THREAT OPS › Threat News › [GHSA] GHSA-wv94-5qcp-6m36 (medium) — PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
[GHSA] GHSA-wv94-5qcp-6m36 (medium) — PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
GHSA-wv94-5qcp-6m36 Severity: medium CVE: CVE-2026-55531
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
### Summary
The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions (_cleanup_sessions) is defined but ne
Indicators of compromise
- CVE-2026-55531cve
- http://127.0.0.1:8080/mcpurl
- http://127.0.0.1:8080/healthurl
Original source: https://github.com/advisories/GHSA-wv94-5qcp-6m36