CVE-2026-47861 — UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

CVE-2026-47861

UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false PUBLISHED

Description (CNA)

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring Integration	affected 7.1.0; affected 7.0.0 through 7.0.5; affected 6.5.0 through 6.5.10; affected 6.4.0 through 6.4.12; affected 0 through 5.5.21

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47861

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.