Описание
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE
A flaw was found in Spring Framework, specifically within Spring RSocket applications. A remote attacker could exploit this vulnerability by sending a malformed SETUP frame to an affected application. This could lead to a memory leak, potentially causing a denial of service.
Отчет
A flaw was found in the Spring RSocket implementation within the Spring Framework. An unauthenticated remote attacker can send a specially crafted SETUP frame during connection initialization, triggering a memory leak. Processing the malformed frame prevents memory release, allowing repeated requests to exhaust application heap memory and lead to a denial of service. Standard Red Hat container deployments operating without exposed RSocket endpoints are not directly exposed to this issue.
Меры по смягчению последствий
Disable RSocket transport listeners on the application if RSocket features are not actively utilized. If RSocket is required, restrict network connectivity to the RSocket port using ingress firewalls, API gateways, or service mesh network policies.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence/agent-client-rhel9 | Not affected | ||
| OpenShift Developer Tools and Services | jenkins | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-quarkus-support-spring-beans | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-quarkus-support-spring-context | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | camel-quarkus-support-spring-core | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-amqp | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-aop | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-expression | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-jdbc | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | spring-jms | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE
A Spring RSocket application is exposed to a memory leak via a malform ...
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE
EPSS
7.5 High
CVSS3