Description

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T06:17:19.623Z",
  "pubdate": "2026-08-27T06:17:19.623Z",
  "executiveSummary": "A memory leak vulnerability exists in Spring Framework RSocket implementations, triggered by the processing of malformed SETUP frames.\nThis vulnerability allows an unauthenticated, remote attacker to trigger excessive memory consumption, potentially leading to a Denial of Service (DoS) condition via OutOfMemoryError.\nThe flaw affects a wide range of Spring Framework versions, including 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.0.RELEASE-5.2.25.RELEASE.\nThe risk is characterized by the ease of exploitation; an attacker only requires network access to the RSocket endpoint to send a crafted payload.\nSuccessful exploitation forces the application to allocate and retain buffers or resources unnecessarily, exhausting the heap memory of the JVM.\nOrganizations relying on Spring-based RSocket servers should prioritize patching, as this vulnerability requires minimal attacker effort to severely impact service availability.",
  "technicalDetails": "The vulnerability resides within the RSocket connection establishment logic in the Spring Framework. Specifically, the handling of the RSocket SETUP frame lacks sufficient validation or proper resource cleanup when encountering malformed data during the initial handshake process.\nWhen an RSocket server receives a SETUP frame, it initiates a connection process that involves parsing frame metadata and setting up connection state. If the frame is malformed—containing, for example, inconsistent data lengths or unexpected payload structures—the internal decoding logic may fail to correctly dispose of allocated byte buffers or associated connection objects.\nThe root cause is an improper resource management pattern during the error-handling path of the SETUP frame processing. When an error occurs due to the malformed frame, the application fails to release the underlying memory buffers allocated to hold the incoming frame, causing these objects to remain in the heap.\nAn attacker can exploit this by repeatedly sending specially crafted, malformed SETUP frames to the RSocket endpoint. Because the connection establishment is an early-stage process, this can be performed without any authentication or privilege requirements. Each malformed frame causes a incremental leak of heap memory.\nThe attack flow is as follows: 1. The attacker opens a raw TCP connection to the exposed RSocket port. 2. The attacker transmits a crafted, malformed RSocket SETUP frame designed to trigger an error in the parser. 3. The server catches the parsing exception but fails to deallocate the associated memory buffers. 4. The attacker repeats this action at a high frequency. 5. Over time, the accumulated leaked memory consumes the heap, eventually triggering a Java OutOfMemoryError (OOM) and causing the application to crash or become unresponsive to legitimate traffic.\nThis vulnerability is particularly impactful because it affects the connection-handling infrastructure, making it difficult to mitigate via application-level filters. The persistent memory growth is a direct consequence of the server's failure to adhere to strict resource lifecycle management during the connection handshake phase."
}