An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an… (CVE-2026-47861)

An unauthenticated remote attacker can exploit a flaw in the Spring Integration UDP inbound adapter by sending a crafted UDP packet. This causes the server to send an outbound UDP datagram to an arbitrary internal or external host and port specified by the attacker. The vulnerability affects multiple versions of Spring Integration, including 5.5.21 and earlier, 6.4.0 to 6.4.12, 6.5.0 to 6.5.10, 7.0.0 to 7.0.5, and 7.1.0. The CVSS 3.1 base score is 6.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality, integrity, and availability impacts.

An attacker can cause the vulnerable server to send UDP packets to arbitrary hosts and ports, potentially enabling network abuse such as reflection or amplification attacks. The impact includes limited confidentiality, integrity, and availability effects as per the CVSS vector. There is no indication of direct code execution or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider restricting UDP traffic to the Spring Integration UDP inbound adapter and monitoring for unusual outbound UDP datagrams to mitigate potential abuse.