CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

What is CVE-2026-47859?

CVE-2026-47859 is a medium-severity denial of service vulnerability in Spring Integration, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Weakness: CWE-770

Which versions are affected by CVE-2026-47859?

It affects 1 product.

Products include Vmware Spring Integration.

How do I fix CVE-2026-47859?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-47859 being exploited?

There is no known exploitation of CVE-2026-47859 in the wild and no public exploit code.

Other vulnerabilities in Spring Integration

• CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction High 8.2
• CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference High 8.0
• CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem High 7.1
• CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation Medium 6.8
• CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1 Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wh6x-77fw-hcqh.