Executive brief
Spring Integration's syslog message decoder accepts network messages and allocates memory based on a size field provided by the sender, without any upper limit. An attacker can send a message claiming to be extremely large, causing the application to attempt allocating huge amounts of memory and crash or become unresponsive, disrupting services that depend on processing syslog events.
Technical details
The RFC6587SyslogDeserializer component in Spring Integration, used by the syslog TCP inbound adapter, trusts an octet count field from untrusted RFC 5424 / RFC 6587 frames without validation. An attacker can provide an arbitrarily large octet count, causing the deserializer to allocate a byte array of that exact size with no upper bound checks. This leads to memory exhaustion and denial of service. The vulnerability affects Spring Integration 7.1.0, 7.0.0–7.0.5, 6.5.0–6.5.10, 6.4.0–6.4.12, and 5.5.21 and earlier. The attack vector is network-based and requires only the ability to send data to the syslog TCP inbound adapter.
Affected products
- Spring Integration 5.5.21 and earlier, 6.4.0–6.4.12, 6.5.0–6.5.10, 7.0.0–7.0.5, 7.1.0
Timeline
- 2026-08-27: disclosed: CVE-2026-47859 published