Vulnerability · Published Aug 26, 2026 · Assigned by vmware
CVE-2026-47859Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
Medium 5.4
In plain English
A medium-severity resource allocation without limits in Spring Integration from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Integration | 7.1.07.0.0 – through 7.0.56.5.0 – through 6.5.106.4.0 – through 6.4.120 – through 5.5.21 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N