CVE-2026-47861

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-47861

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47861.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-47861

Published

2026-08-26T23:49:25Z

Modified

2026-09-04T03:45:59Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

Details

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Database specific

{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47861.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.1.0"
                },
                {
                    "last_affected": "7.1.0"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.5"
                },
                {
                    "introduced": "6.5.0"
                },
                {
                    "last_affected": "6.5.10"
                },
                {
                    "introduced": "6.4.0"
                },
                {
                    "last_affected": "6.4.12"
                },
                {
                    "last_affected": "5.5.21"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/spring-projects/spring-integration

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-integration

Events

Introduced

79963f89e3cab04addfe32aa4b419e5ffb73e909

Fixed

ae4c9bb8eff504f26b67cc6ac65fed2c8fb8382e

Database specific

Show details

{
    "cpe": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.1.0"
        },
        {
            "fixed": "7.1.0.1"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47861.json"