Executive brief
Spring Framework, a widely-used Java application framework, is vulnerable to a memory leak when processing malformed RSocket protocol SETUP frames. An attacker with network access can send specially crafted frames to cause the application to leak memory, potentially leading to denial of service through resource exhaustion and application crashes.
Technical details
The vulnerability is a memory leak triggered by malformed RSocket SETUP frames in Spring Framework's RSocket protocol handler. When an application built on Spring Framework receives a specially crafted SETUP frame that violates the RSocket protocol specification, the frame processing code fails to properly clean up allocated resources, causing memory to be retained indefinitely. The attack requires only network connectivity to the RSocket endpoint and no authentication or user interaction. Repeated exploitation leads to progressive memory exhaustion, ultimately causing the application to become unavailable. Patches are available for all affected version branches.
Affected products
- Spring Spring Framework 5.2.0.RELEASE – 5.2.25.RELEASE, 5.3.0 – 5.3.49, 6.0.0 – 6.0.30, 6.1.0 – 6.1.28, 6.2.0 – 6.2.19, 7.0.0 – 7.0.8
Timeline
- 2026-08-27: disclosed