CVE-2026-47888

A flaw was found in Spring Framework, specifically within Spring RSocket applications. A remote attacker could exploit this vulnerability by sending a malformed SETUP frame to an affected application. This could lead to a memory leak, potentially causing a denial of service.

A flaw was found in the Spring RSocket implementation within the Spring Framework. An unauthenticated remote attacker can send a specially crafted SETUP frame during connection initialization, triggering a memory leak. Processing the malformed frame prevents memory release, allowing repeated requests to exhaust application heap memory and lead to a denial of service. Standard Red Hat container deployments operating without exposed RSocket endpoints are not directly exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable RSocket transport listeners on the application if RSocket features are not actively utilized. If RSocket is required, restrict network connectivity to the RSocket port using ingress firewalls, API gateways, or service mesh network policies.