CVE-2026-47859: CWE-770 Allocation of Resources Without Limits or Throttling in Spring Spring Integration

The vulnerability arises from the RFC6587SyslogDeserializer in Spring Integration's syslog TCP inbound adapter, which decodes RFC 6587 / RFC 5424 frames. It relies on the sender-supplied octet count to allocate a byte array of exactly that size without imposing an upper bound. This lack of limits on resource allocation can lead to excessive memory consumption, potentially affecting system stability or availability. The issue affects multiple versions of Spring Integration, including 5.5.21 and earlier, 6.4.0 to 6.4.12, 6.5.0 to 6.5.10, 7.0.0 to 7.0.5, and 7.1.0. The CVSS v3.1 base score is 5.4, indicating medium severity. There is no vendor advisory or patch information provided at this time.

The vulnerability allows an attacker to cause allocation of large amounts of memory by sending crafted syslog frames with a large octet count. This can lead to resource exhaustion on the affected system, potentially degrading performance or causing denial of service. The impact on confidentiality, integrity, and availability is limited to low for confidentiality and integrity, and no direct impact on availability is confirmed. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the syslog TCP inbound adapter to untrusted networks or implement network-level controls to restrict potentially malicious input. Avoid processing untrusted syslog input where possible.