Vulnerability · Published Aug 26, 2026 · Assigned by vmware

CVE-2026-47859Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

Medium 5.4

In plain English

A medium-severity resource allocation without limits in Spring Integration from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 78.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected products (as reported)

Vendor	Product	Versions
Spring	Spring Integration	7.1.07.0.0 – through 7.0.56.5.0 – through 6.5.106.4.0 – through 6.4.120 – through 5.5.21

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://spring.io/security/cve-2026-47859