CVE-2026-47861 Security Details

CVE ID

CVE-2026-47861

CWE

CWE-918

CVE Description

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Published

Aug 20, 2026

CVSS Score & Severity

5.3Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

EPSS Score

0.327%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/integration/ip/udp/UnicastReceivingChannelAdapter.sendAck(Lorg/springframework/messaging/Message;)V

JVM

org/springframework/integration/ip/udp/inbound/UnicastReceivingChannelAdapter.sendAck(Lorg/springframework/messaging/Message;)V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT