CVE-2026-47859: Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the Spring Integration syslog TCP inbound adapter to process RFC 6587 or RFC 5424 octet-counted frames are exposed when running one of the listed affected Spring Integration versions.
What does an attacker need to exploit this issue?
The severity vector indicates network access and low privileges are required. No user interaction is required.
How can I determine whether an environment is affected?
Check whether the application uses the Spring Integration syslog TCP inbound adapter and whether its Spring Integration version is 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, or 5.5.21 or earlier.