CyberRota Analysis
AI-GeneratedThe vulnerability affects the Spring Integration framework, specifically the RFC6587SyslogDeserializer component, which improperly trusts the sender-supplied octet count when decoding syslog frames. This flaw can lead to potential denial-of-service conditions due to excessive memory allocation, making it critical for organizations using affected Spring Integration versions (5.5.21 and earlier, as well as 6.4.0 to 7.1.0) to prioritize patching. Users of these versions should assess their exposure and implement mitigations to prevent exploitation.
Original NVD Description
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)