---
title: "Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS"
url: https://daily.dev/posts/unbounded-memory-allocation-in-rfc6587syslogdeserializer-octet-counted-framing-remote-dos-fktfnzmbj
source_url: https://spring.io/security/cve-2026-47859
type: article
source: "Spring"
published: 2026-08-20T16:42:37.858Z
updated: 2026-08-20T16:43:16.292Z
tags: ["cyber", "java", "spring"]
reading_time: 1
upvotes: 2
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

**[Spring](https://daily.dev/sources/spring)** · 1 min read · 2 upvotes · 0 comments

## Summary

A security advisory describes a remote denial-of-service vulnerability in Spring's RFC6587SyslogDeserializer, where octet-counted framing parsing can trigger unbounded memory allocation, allowing an attacker to exhaust memory resources. No further technical details, affected version ranges, or remediation guidance are visible beyond the advisory title and a cookie consent notice.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://spring.io/security/cve-2026-47859>

## Questions this post answers

### What is the vulnerability in Spring's RFC6587SyslogDeserializer related to octet-counted framing?

RFC6587SyslogDeserializer in Spring is affected by an unbounded memory allocation issue when parsing octet-counted framing, which can be exploited remotely to cause a denial of service by exhausting available memory. Specific affected version numbers and a patched release are not detailed beyond the advisory title itself.

_Track Spring CVE advisories like this one on daily.dev before they hit production syslog pipelines._

## Similar posts on daily.dev

- [Unbounded decompression of attacker-supplied compressed message bodies](https://daily.dev/posts/unbounded-decompression-of-attacker-supplied-compressed-message-bodies-t6ypckd13) · Spring · 2 upvotes · 0 comments

---

Tags: [#cyber](https://daily.dev/tags/cyber), [#java](https://daily.dev/tags/java), [#spring](https://daily.dev/tags/spring)

[View this post on daily.dev](https://daily.dev/posts/unbounded-memory-allocation-in-rfc6587syslogdeserializer-octet-counted-framing-remote-dos-fktfnzmbj)