A memory leak vulnerability in the Spring Framework allows remote, unauthenticated attackers to cause a denial of service condition in RSocket-enabled applications.

The vulnerability is a memory leak (CWE-401) triggered when a Spring RSocket application processes a malformed SETUP frame. This flaw is exploitable by an unauthenticated attacker over the network.

The exploitation of this vulnerability results in a denial of service, potentially leading to application crashes or significant service degradation due to memory exhaustion. With a CVSS score of 7.5, this high-severity flaw poses a notable risk to availability for any business-critical service relying on RSocket communications. Prolonged service disruption can lead to operational downtime and potential loss of productivity.

Immediate Action: Review the official Spring security advisory for available patches and update affected Spring Framework deployments to the latest non-vulnerable release.

Proactive Monitoring: Monitor application memory usage metrics and RSocket traffic logs for spikes in malformed requests or unexpected memory consumption patterns.

Compensating Controls: Implement network-level rate limiting or WAF rules capable of inspecting and validating RSocket frames to drop malformed traffic before it reaches the application layer.

Public Exploit Available: No

Given the high severity and the potential for service disruption, organizations should prioritize identifying all instances of Spring Framework within their environment. Once the vendor releases the specific patched versions, teams should proceed with testing and deployment immediately to mitigate the risk of memory exhaustion attacks.