Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limits sessions through PRAISONAI_MCP_MAX_SESSIONS. This issue is fixed in version 4.6.58.

Affected: PyPI: PraisonAI

### Summary

The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions (_cleanup_sessions) is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. There is no cap on the number of sessions. Because initialize requires no authentication and the server keeps every session dictionary forever, an attacker who can reach the endpoint (directly when the server is bound to a routable address, or from a victim's browser via the separate Origin-validation bypass) can drive memory usage up without bound until the process is killed by the out-of-memory killer. The same unbounded-growth pattern also applies to the cancelled-requests set populated by notifications/cancelled.

### Details

In transports/http_stream.py, each initialize creates and stores a session with no limit:

```python if body.get("method") == "initialize": new_session_id = str(uuid.uuid4()) self._sessions[new_session_id] = { "created_at": time.time(), "last_activity": time.time(), } ```

A cleanup method exists:

```python def _cleanup_sessions(self) -> None: now = time.time() expired = [sid for sid, data in self._sessions.items() if now - data["last_activity"] > self.session_ttl] for sid in expired: del self._sessions[sid] ```

but grep across the package shows it has no call sites: it is never invoked…