CVE-2026-47888
Received Received - Intake

Memory Leak in Spring Framework via Malformed SETUP Frame

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47888
EUVD
EUVD-2026-66856

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
spring_project spring_framework to 7.0.8 (inc)
spring_project spring_framework to 6.2.19 (inc)
spring_project spring_framework to 6.1.28 (inc)
spring_project spring_framework to 6.0.30 (inc)
spring_project spring_framework to 5.3.49 (inc)
spring_project spring_framework to 5.2.25.release (inc)
spring framework From 7.0.0 (inc) to 7.0.8 (inc)
spring framework From 6.2.0 (inc) to 6.2.19 (inc)
spring framework From 6.1.0 (inc) to 6.1.28 (inc)
spring framework From 6.0.0 (inc) to 6.0.30 (inc)
spring framework From 5.3.0 (inc) to 5.3.49 (inc)
spring framework From 5.2.0 (inc) to 5.2.25 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in Spring Framework applications that use RSocketMessageHandler. It occurs when the application processes malformed SETUP frames, which are part of the RSocket protocol. The issue affects multiple versions of Spring Framework, allowing memory to be improperly allocated and not released, potentially leading to resource exhaustion.

Detection Guidance

Detecting this vulnerability requires checking if your Spring Framework application uses RSocketMessageHandler and is running a vulnerable version. Inspect application logs for malformed SETUP frame errors or unusual memory usage patterns. Use commands like 'curl -I http://your-server/rsocket' to check RSocket endpoints or 'jcmd <pid> VM.native_memory summary' to monitor memory leaks.

Impact Analysis

The memory leak could degrade application performance by consuming excessive memory, leading to slowdowns or crashes. In severe cases, it may cause denial-of-service conditions where the application becomes unresponsive due to resource exhaustion.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical memory leak issue in Spring Framework applications. However, if exploited, it could lead to denial-of-service conditions, potentially impacting availability requirements under these regulations. No specific compliance impact is mentioned in the provided resources.

Mitigation Strategies

Upgrade to fixed versions of Spring Framework: 7.0.9, 6.2.20, 6.1.29, 6.0.31, 5.3.50, or 5.2.26.RELEASE. For enterprise-supported versions, apply the vendor-provided patches. No additional mitigation steps are required beyond applying these updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47888. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart