CVE-2026-47861 UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

What is CVE-2026-47861?

CVE-2026-47861 is a medium-severity server-side request forgery vulnerability in Spring Integration, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Weakness: CWE-918

Which versions are affected by CVE-2026-47861?

It affects 1 product.

Products include Vmware Spring Integration.

How do I fix CVE-2026-47861?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-47861 being exploited?

There is no known exploitation of CVE-2026-47861 in the wild and no public exploit code.

Other vulnerabilities in Spring Integration

• CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction High 8.2
• CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference High 8.0
• CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem High 7.1
• CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation Medium 6.8
• CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1 Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-653q-gpwq-hvhw.