CyberRota Analysis
AI-GeneratedThe vulnerability affects the PraisonAI multi-agent teams system, where the MCP HTTP Stream mcp_post handler fails to properly manage session entries, allowing an unauthenticated attacker to exhaust system memory. This can lead to denial of service, impacting the availability of the service. Organizations using versions prior to 4.6.58 should prioritize upgrading to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limits sessions through PRAISONAI_MCP_MAX_SESSIONS. This issue is fixed in version 4.6.58.