## cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

- 種別: advisory
- 関連技術: spring, java
- CVE: CVE-2026-47859
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-47859)
- パーマリンク: https://vulnpulse.app/items/spring-security-928e9eb6f638

RFC6587SyslogDeserializer , used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. A client that can deliver frames to the listener can declare an arbitrarily large frame length and force the server into a huge heap allocation, leading to memory exhaustion and denial of service. The non-transparent (LF-delimited) framing path is not affected: it delegates to ByteArrayLfSerializer , which enforces maxMessageSize (default…