Spring Integration CVE-2026-47859

Exploitation requires that the Spring Integration application deploys the syslog TCP inbound adapter and that it is configured to accept RFC 6587 octet-counting framed messages (the RFC6587SyslogDeserializer code path). The CVSS PR:L metric indicates the attacker must have some degree of permission to send syslog traffic to the TCP port - in practice this typically means network-level reachability to the adapter's port rather than formal application authentication, but environments that restrict syslog intake to specific source IPs or authenticated clients raise the practical bar. Applications that use Spring Integration without this specific syslog adapter component, or that use only the non-transparent (trailer-based) framing mode, are not affected. The vulnerability is further scoped by the fact that a victim application must be running one of the affected version branches (5.5.21 and earlier, 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, or 7.1.0).

The CVSS 3.1 score of 5.4 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects a network-reachable, low-complexity attack requiring low privileges. The absence of an availability impact metric (A:N) is notable given that unbounded byte-array allocation is classically a resource exhaustion primitive; the vendor scoring suggests primary harm is cross-frame data leakage (C:L) and message boundary corruption (I:L) rather than denial of service, possibly because JVM-level OOM handling or stream blocking semantics prevent a hard crash. No EPSS score is available in the provided data, the vulnerability does not appear in CISA KEV, and no POC code has been identified - all signals consistent with lower active exploitation likelihood. Real-world risk is scoped to deployments that expose the Spring Integration syslog TCP inbound adapter to untrusted or semi-trusted senders; applications not using this specific adapter component are entirely unaffected regardless of Spring Integration version.

An attacker with TCP access to the Spring Integration syslog inbound port crafts an RFC 6587 octet-counted syslog frame in which the stated byte count far exceeds the actual payload length. The deserializer allocates a byte array matching the inflated count and reads that many bytes from the TCP stream, consuming data from subsequent frames sent by other syslog clients or internal sources - potentially leaking those messages' content to the attacker or corrupting the frame parsing state. No public exploit code exists at time of analysis, but the attack requires only a TCP connection and a crafted length prefix with no specialized tooling.