Memory leak in Spring Framework - CVE-2026-47888

Vulnerability identifier: #VU146220

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47888

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in RSocketMessageHandler when processing a malformed SETUP frame. A remote attacker can send a specially crafted SETUP frame to cause a denial of service.

Spring Framework
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version

Install security update from vendor's website.

Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0

• https://spring.io/security/cve-2026-47888

• Multiple vulnerabilities in Spring Framework
• Multiple vulnerabilities in IBM Library Support for Spring
• Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data