CVE-2026-47859
Received Received - Intake

Denial of Service in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47859
EUVD
EUVD-2026-66825

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
spring integration 7.1.0
spring integration to 7.0.5 (inc)
spring integration to 6.5.10 (inc)
spring integration to 6.4.12 (inc)
spring integration to 5.5.21 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47859 is a medium-severity vulnerability in the Spring Integration syslog TCP inbound adapter. It involves unbounded memory allocation in the RFC6587SyslogDeserializer component, which processes syslog frames using octet-counted framing. The deserializer trusts the sender-supplied octet count without an upper limit, allowing attackers to force excessive heap allocations by sending frames with very large declared lengths. This can lead to memory exhaustion and a denial-of-service condition.

Detection Guidance

Monitor for unusual network traffic patterns targeting syslog TCP ports, particularly large payloads or rapid bursts of octet-counted frames. Check for memory exhaustion errors in application logs or system monitoring tools. Inspect network traffic with tools like tcpdump or Wireshark for malformed RFC 6587 frames with excessively large declared lengths.

Impact Analysis

This vulnerability can impact you by causing a denial-of-service (DoS) condition. Attackers could exploit it to exhaust system memory, leading to crashes or degraded performance of applications using affected versions of Spring Integration. Systems processing syslog messages via TCP inbound adapters are particularly at risk.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions through memory exhaustion, which could disrupt logging systems. While not directly violating GDPR or HIPAA, such disruptions may impact data integrity and availability requirements under these regulations. Organizations must ensure logging systems remain operational to maintain compliance.

Mitigation Strategies

Upgrade to a patched version of Spring Integration that enforces a maximum message size for octet-counted frames. If upgrading is not immediately possible, restrict network access to syslog TCP ports or implement rate limiting to prevent excessive memory allocation. Monitor system resources closely for signs of memory exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart