Spring RSocket Memory Leak via Malformed SETUP Frame

CVE-2026-47888 is a memory leak vulnerability affecting multiple versions of the Spring Framework across a wide range of releases (5.2 through 7.0). The vulnerability is triggered when a Spring RSocket application receives a specially crafted SETUP frame, causing improper resource management that leads to memory exhaustion over time. RSocket is a binary protocol for reactive communication, commonly used in microservices architectures and cloud-native applications. With a CVSS score of 7.5, this vulnerability poses a significant availability risk—attackers can send malformed frames to cause denial of service through memory depletion, impacting any organization running vulnerable Spring Framework versions in RSocket-enabled deployments.

While this CVE does not map directly to MITRE ATT&CK techniques, Casky's AI-driven skills excel at detecting the underlying attack patterns through behavioral analysis of resource consumption and protocol anomalies. Practitioners using Casky would observe findings related to CWE-401 (improper resource cleanup) manifesting as: abnormal memory growth correlating with RSocket SETUP frame traffic, orphaned connection objects that fail to release allocated buffers, and statistical deviations in frame processing latency. Claude's extended reasoning capabilities enable Casky to correlate these signals—recognizing that legitimate RSocket handshakes follow predictable memory profiles, while malformed frames trigger characteristic allocation patterns that deviate from baseline behavior. Practitioners would see alerts highlighting suspicious SETUP frame characteristics, memory allocation spikes tied to specific connection patterns, and recommendations to update to patched versions (7.0.9+, 6.2.20+, 6.1.29+, 6.0.31+, or 5.3.50+).