Spring Framework 5.2-7 RSocket memory leak via malformed SETUP frame
CVE-2026-47888 Published on August 27, 2026
Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE
Products Associated with CVE-2026-47888
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Framework:- Version 7.0.0, <= 7.0.8 is affected.
- Version 6.2.0, <= 6.2.19 is affected.
- Version 6.1.0, <= 6.1.28 is affected.
- Version 6.0.0, <= 6.0.30 is affected.
- Version 5.3.0, <= 5.3.49 is affected.
- Version 5.2.0.RELEASE, <= 5.2.25.RELEASE is affected.