Skip to content
fr Sign in
6.3 Medium

CVE-2026-47861 An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can…

Description

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected products and versions

Product Affected versions Fixed in
Spring Integration 7.1.0 No fix stated
Spring Integration 7.0 7.0.0 → 7.0.5 No fix stated
Spring Integration 6.5 6.5.0 → 6.5.10 No fix stated
Spring Integration 6.4 6.4.0 → 6.4.12 No fix stated
Spring Integration 5.5 earliest → 5.5.21 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Integration

The 16 CVEs of Spring Integration →
CVE-2026-59324 When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,… 8.2 High CVE-2026-59322 The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor 6.3 Medium CVE-2026-59321 A single ScriptEngine instance is reused for every message on a script-backed channel 4.2 Medium CVE-2026-59311 A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their… 6.8 Medium
Track this CVE