CVE-2026-47859

Overview

Spring Integration extends the Spring programming model to support the well-known Enterprise Integration Patterns, providing message channels, endpoints, transformers, and channel adapters that let Spring applications exchange data with external systems over protocols such as HTTP, JMS, AMQP, TCP/UDP, syslog, and the file system.

A Denial of Service (DoS) vulnerability (CVE-2026-47859) has been identified in the RFC6587SyslogDeserializer component of Spring Integration, which allows attackers to declare an arbitrarily large octet-counted frame length in a small syslog frame and force the receiving JVM into a correspondingly large heap allocation.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects the syslog inbound adapter support of Spring Integration. Exposure is limited to applications that wire the TCP inbound adapter for RFC 5424 framing, meaning a TCP server connection factory whose deserializer is an RFC6587SyslogDeserializer. It is not the default configuration: the adapter defaults to the bounded ByteArrayLfSerializer, and UDP or RFC 3164/BSD deployments are not exposed.

‍

Details

Module Info

• Product: Spring Integration
• Affected packages: org.springframework.integration:spring-integration-syslog
• Affected versions: >= 4.1.1 < 5.5.22, >= 6.0.0 < 6.4.13, >= 6.5.0 < 6.5.11, >= 7.0.0 < 7.0.6, >= 7.1.0 < 7.1.1
• GitHub repository: https://github.com/spring-projects/spring-integration
• Published packages: https://central.sonatype.com/artifact/org.springframework.integration/spring-integration-syslog
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Integration lines 5.5.x, 6.2.x, 6.3.x, 6.4.x and 6.5.x
  • OSS Spring Integration 7.0.6 and 7.1.1

Vulnerability Info

This Medium-severity vulnerability is found in the org.springframework.integration:spring-integration-syslog package in the syslog inbound adapter support of Spring Integration.

RFC 6587 allows a syslog frame to be octet-counted, meaning the sender prefixes the frame with its length in bytes. The deserializer parsed that length out of the stream and used it directly as the size of the receive buffer:

@Override
public Map<String, ?> deserialize(InputStream inputStream) throws IOException {
    DataInputStream stream = new DataInputStream(inputStream);
    String line;
    int octetCount = 0;
    boolean shortRead = false;
    int peek = stream.read();
    if (isDigit(peek)) {
        octetCount = calculateLength(stream, peek);
        Assert.state(octetCount > 0, "Expected length > 0");
        byte[] bytes = new byte[octetCount];
        ...
    }
    ...
}

private int calculateLength(DataInputStream stream, int peek) throws IOException {
    int length = peek & 0xf; // NOSONAR magic number
    int c = stream.read();
    while (isDigit(c)) {
        length = length * 10 + (c & 0xf); // NOSONAR magic number
        c = stream.read();
    }
    return length;
}

calculateLength() accumulates digits with no ceiling and deserialize() allocates new byte[octetCount] before a single payload byte has been read, so any client able to reach the listener can trigger a very large allocation with a handful of digits. A longer digit run instead overflows the accumulator to a negative value, which the Assert.state(octetCount > 0) guard rejects, so an unchecked IllegalStateException escapes deserialize() rather than the IOException the framing contract promises. That is a separate robustness defect the same patch closes. The non-transparent, LF-delimited framing path was not exposed in the same way because it delegates to a serializer that already enforces a maximum message size.

This vulnerability was introduced in 2014 with Spring Integration 4.1.1.

‍

Mitigation

Only recent versions of Spring Integration receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Integration. Note that the fix changes default behavior: octet-counted syslog frames are capped at 2048 bytes, so a deployment that legitimately receives larger frames must raise the ceiling with the new setMaxMessageSize(int) on RFC6587SyslogDeserializer.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Uwez Khan (finder)
• Yu Bao from PayPal Cybersecurity Team (finder)