Driver or application errors can result in an unbounded number of cached sessions, and that can result in performance degradation and eventually OOM. It would be useful to provide a sanity check, say at 1 M cached sessions, and warn or refuse further sessions when it is exceeded.

Fix Implementation

The commands that add new sessions to the cache are start_session_command, refresh_sessions_command and refresh_sessions_command_internal. These commands will now return false when the cache is full. The maximum number of sessions can be configured through an optional argument to the mongod command (maxSessions) and will default to 1M. LogicalSessionCacheImpl::_addToCache https://github.com/mongodb/mongo/blob/master/src/mongo/db/logical_session_cache_impl.cpp#L102  and LogicalSessionCacheImpl::startSession will now return a Status instead of void.