CVE-2026-47888

Analyzed Analyzed - Analysis Complete

Memory Leak in Spring Framework via Malformed SETUP Frame

Publication date: 2026-08-27

Last updated on: 2026-09-10

Assigner: VMware

Description

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-10

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47888

EUVD

EUVD-2026-66856

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 6.2.0 (inc) to 6.2.20 (exc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.29 (exc)
vmware	spring_framework	From 5.3.0 (inc) to 5.3.50 (exc)
vmware	spring_framework	From 6.0.0 (inc) to 6.0.31 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8.1 (exc)
vmware	spring_framework	From 5.2.0 (inc) to 5.2.26 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory leak in Spring Framework applications that use RSocketMessageHandler. It occurs when the application processes malformed SETUP frames, which are part of the RSocket protocol. The issue affects multiple versions of Spring Framework, allowing memory to be improperly allocated and not released, potentially leading to resource exhaustion.

Detection Guidance

Detecting this vulnerability requires checking if your Spring Framework application uses RSocketMessageHandler and is running a vulnerable version. Inspect application logs for malformed SETUP frame errors or unusual memory usage patterns. Use commands like 'curl -I http://your-server/rsocket' to check RSocket endpoints or 'jcmd <pid> VM.native_memory summary' to monitor memory leaks.

Impact Analysis

The memory leak could degrade application performance by consuming excessive memory, leading to slowdowns or crashes. In severe cases, it may cause denial-of-service conditions where the application becomes unresponsive due to resource exhaustion.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical memory leak issue in Spring Framework applications. However, if exploited, it could lead to denial-of-service conditions, potentially impacting availability requirements under these regulations. No specific compliance impact is mentioned in the provided resources.

Mitigation Strategies

Upgrade to fixed versions of Spring Framework: 7.0.9, 6.2.20, 6.1.29, 6.0.31, 5.3.50, or 5.2.26.RELEASE. For enterprise-supported versions, apply the vendor-provided patches. No additional mitigation steps are required beyond applying these updates.

Hi! I’m here to help you understand CVE-2026-47888. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70