Description
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
Published: 2026-08-26
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://spring.io/security/cve-2026-47859 cve-icon cve-icon
History

Thu, 27 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
CWE-789

Thu, 27 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
CWE-789

Thu, 27 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Spring
Spring spring Integration
Vendors & Products Spring
Spring spring Integration

Thu, 27 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Description RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Title Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Spring Spring Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-08-27T14:48:52.190Z

Reserved: 2026-05-20T10:00:55.156Z

Link: CVE-2026-47859

cve-icon Vulnrichment

Updated: 2026-08-27T14:48:46.701Z

cve-icon NVD

Status : Received

Published: 2026-08-27T01:17:32.850

Modified: 2026-08-27T17:18:30.863

Link: CVE-2026-47859

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T17:30:12Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling