CVE-2026-47861: CWE-918 Server-Side Request Forgery (SSRF) in Spring Spring Integration

CVE-2026-47861 is a CWE-918 SSRF vulnerability in Spring Integration's UDP inbound adapter. It allows an unauthenticated remote attacker to send a crafted UDP packet that causes the server to emit an outbound UDP datagram to an arbitrary internal or external host and port specified by the attacker. Affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The vulnerability is publicly known but no patch or official remediation guidance has been published as of the data provided.

The vulnerability allows an unauthenticated attacker to induce the server to send UDP packets to arbitrary destinations. This could be used to bypass network restrictions, perform internal network scanning, or facilitate other attacks that rely on SSRF. The impact includes limited confidentiality, integrity, and availability effects as indicated by the CVSS vector (C:L/I:L/A:L). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the UDP inbound adapter and monitoring network traffic for unusual outbound UDP datagrams. Avoid exposing the UDP inbound adapter to untrusted networks.