[BUG] ShenyuStreamableHttpServerTransportProvider.createSessionAndRestoreId leaks sessions

[Aias00]

• severity: High
• files: shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/transport/ShenyuStreamableHttpServerTransportProvider.java:461-490
• description: When a client sends a request with a sessionId that does not exist (server restart, timeout, stale client), createSessionAndRestoreId creates a new McpServerSession+StreamableHttpSessionTransport, stores them in sessions/sessionTransports, and processes one request — but, unlike createTemporarySessionAndProcess (which has a .doFinally(...removeSession...)), the restore path has no cleanup hook. The session and transport remain in both maps forever.
• impact: Unbounded memory growth of sessions/sessionTransports/ShenyuMcpExchangeHolder via the stale-session restore path.
• suggested_fix: Add a doFinally to createSessionAndRestoreId that calls removeSession(actualSessionId) and ShenyuMcpExchangeHolder.remove(actualSessionId).
• confidence: High
• related_existing: none — [BUG] MCP rule removal can leave custom-named tools registered #6473/[BUG] the tools of the mcp-server need to be reopened before they can take effect #6117 are different defects.

---

Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] ShenyuStreamableHttpServerTransportProvider.createSessionAndRestoreId leaks sessions
• Link: [BUG] ShenyuStreamableHttpServerTransportProvider.createSessionAndRestoreId leaks sessions #6644

Please review when you have time. Thank you! 🙏