CLEANSTART-2026-VY24867: Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Q: What does an attacker need to exploit this issue?

The attack is network-based, requires low complexity, and does not require privileges or user interaction. An attacker would need to be able to send a malformed RSocket SETUP frame to the affected application.

Q: What is the expected security impact?

The reported impact is high availability impact from a memory leak. The provided scoring indicates no confidentiality or integrity impact.

Q: Which deployments should be prioritized for triage?

Prioritize cleanstart/rundeck deployments running a Spring RSocket application that can receive network RSocket traffic. The provided data does not identify affected versions or state whether any particular configuration is affected by default.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47888

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attack is network-based, requires low complexity, and does not require privileges or user interaction. An attacker would need to be able to send a malformed RSocket SETUP frame to the affected application.

What is the expected security impact?

The reported impact is high availability impact from a memory leak. The provided scoring indicates no confidentiality or integrity impact.

Which deployments should be prioritized for triage?

Prioritize cleanstart/rundeck deployments running a Spring RSocket application that can receive network RSocket traffic. The provided data does not identify affected versions or state whether any particular configuration is affected by default.

CLEANSTART-2026-VY24867: Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Which deployments should be prioritized for triage?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Which deployments should be prioritized for triage?