It only affects undocumented behavior, no documented behavior is being broken.
If you want to consider breakage of undocumented / unintended behavior as a major change, then every bug you fix would require a major version bump, since when you fix something you are essentially breaking compatibility for anyone who might have possibly relied on the existence of that unintended behavior.
But it is a service that clients connect to via an API.
The API specification is unaffected by this.
It only affects undocumented behavior, no documented behavior is being broken.
If you want to consider breakage of undocumented / unintended behavior as a major change, then every bug you fix would require a major version bump, since when you fix something you are essentially breaking compatibility for anyone who might have possibly relied on the existence of that unintended behavior.