A flaw in the RFC6587SyslogDeserializer logic causes the Spring Integration syslog TCP inbound adapter to trust the octet count field supplied by a remote sender and allocate a byte array of that exact size with no upper bound. This can lead to uncontrolled memory allocation, exhausting the JVM heap and rendering the application unresponsive or causing a crash. The weakness aligns with CWE‑789 and CWE‑400.

Spring Integration is impacted across multiple major releases. Vulnerable versions include 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and all releases 5.5.21 and earlier.

The CVSS score of 5.4 places this issue at a moderate severity level. EPSS data is not available, and it is not listed in CISA KEV, suggesting that widespread exploitation is not yet documented. Attackers would need to establish a TCP connection to the syslog inbound adapter and send frames with an inflated octet count, which can be done remotely over the network. Successful exploitation can consume system memory and cause a denial of service on the affected application.