Overview
About vulnerability
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound.
A client that can deliver frames to the listener can declare an arbitrarily large frame length and force the server into a huge heap allocation, leading to memory exhaustion and denial of service.
The non-transparent (LF-delimited) framing path is not affected: it delegates to ByteArrayLfSerializer, which enforces maxMessageSize (default 2048 bytes). The octet-counted path applies no equivalent ceiling.
Details
- Affected product:
- Apache Log4j , Spring , camel
- Affected packages:
- Spring Boot @ 2.6.15 (+2675 more)