AIKIDO-2026-632806

TL;DR

An ACP server exposed over HTTP or WebSocket creates a permanent routing entry in ConnectionState's sessionStreams, pendingRoutes, and clientResponseRoutes maps for any session id named in a request, notification, or subscription, without checking that the session was ever created. A client that has completed the initial handshake can repeatedly name invented session ids to grow these maps without bound until the server runs out of memory, taking down every session it was handling. The fix validates a session id before routing to it instead of creating a permanent entry for any id it sees.