Medium severity · published Aug 26, 2026
CVE-2026-47861
UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Spring Integration · Spring
7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47861
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47861
Vendor Advisory
https://spring.io/security/cve-2026-47861
More from Spring Integration
9.8
CVE-2026-47864
Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
9.8
CVE-2019-3772
Spring Integration XML External Entity Injection (XXE)
8.2
CVE-2026-59324
fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
8.0
CVE-2026-59307
Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
7.1
CVE-2026-40987
Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization