CVE-2026-47859

Analyzed Analyzed - Analysis Complete

Denial of Service in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-09-04

Assigner: VMware

Description

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-04

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47859

EUVD

EUVD-2026-66825

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_integration	From 6.4.0 (inc) to 6.4.13 (exc)
vmware	spring_integration	From 6.5.0 (inc) to 6.5.11 (exc)
vmware	spring_integration	From 7.0.0 (inc) to 7.0.5.1 (exc)
vmware	spring_integration	From 7.1.0 (inc) to 7.1.0.1 (exc)
vmware	spring_integration	to 5.5.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-47859 is a medium-severity vulnerability in the Spring Integration syslog TCP inbound adapter. It involves unbounded memory allocation in the RFC6587SyslogDeserializer component, which processes syslog frames using octet-counted framing. The deserializer trusts the sender-supplied octet count without an upper limit, allowing attackers to force excessive heap allocations by sending frames with very large declared lengths. This can lead to memory exhaustion and a denial-of-service condition.

Detection Guidance

Monitor for unusual network traffic patterns targeting syslog TCP ports, particularly large payloads or rapid bursts of octet-counted frames. Check for memory exhaustion errors in application logs or system monitoring tools. Inspect network traffic with tools like tcpdump or Wireshark for malformed RFC 6587 frames with excessively large declared lengths.

Impact Analysis

This vulnerability can impact you by causing a denial-of-service (DoS) condition. Attackers could exploit it to exhaust system memory, leading to crashes or degraded performance of applications using affected versions of Spring Integration. Systems processing syslog messages via TCP inbound adapters are particularly at risk.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions through memory exhaustion, which could disrupt logging systems. While not directly violating GDPR or HIPAA, such disruptions may impact data integrity and availability requirements under these regulations. Organizations must ensure logging systems remain operational to maintain compliance.

Mitigation Strategies

Upgrade to a patched version of Spring Integration that enforces a maximum message size for octet-counted frames. If upgrading is not immediately possible, restrict network access to syslog TCP ports or implement rate limiting to prevent excessive memory allocation. Monitor system resources closely for signs of memory exhaustion.

Hi! I’m here to help you understand CVE-2026-47859. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70