CVE-2026-47861: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using a Spring Integration UDP inbound adapter are exposed if an attacker can send a UDP packet to that adapter. The affected releases include 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and 5.5.21 and earlier.
Does setting acknowledge=false prevent the outbound packet?
No. The adapter can send an acknowledgement datagram to the host and port supplied in the packet body even when acknowledge=false.
What can an attacker cause the affected server to do?
A single UDP packet can cause the server to emit a UDP datagram to an arbitrary internal or external host and port selected by the attacker. The described attack does not require authentication.