cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

RFC6587SyslogDeserializer , used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. A client that can deliver frames to the listener can declare an arbitrarily large frame length and force the server into a huge heap allocation, leading to memory exhaustion and denial of service. The non-transparent (LF-delimited) framing path is not affected: it delegates to ByteArrayLfSerializer , which enforces maxMessageSize (default…

Spring Security Advisoriesで読む