{"api_version":"1","generated_at":"2026-08-27T03:55:11+00:00","cve":"CVE-2026-47861","urls":{"html":"https://cve.report/CVE-2026-47861","api":"https://cve.report/api/cve/CVE-2026-47861.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-47861","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-47861"},"summary":{"title":"UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false","description":"An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12\nSpring Integration 5.5.21 and earlier","state":"PUBLISHED","assigner":"vmware","published_at":"2026-08-27 01:17:33","updated_at":"2026-08-27 01:17:33"},"problem_types":["CWE-918 Server-Side Request Forgery (SSRF)"],"metrics":[{"version":"3.1","source":"security@vmware.com","type":"Secondary","score":"6.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}}],"references":[{"url":"https://spring.io/security/cve-2026-47861","name":"https://spring.io/security/cve-2026-47861","refsource":"security@vmware.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47861","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47861","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Spring","product":"Spring Integration","version":"affected 7.1.0 custom","platforms":[]},{"source":"CNA","vendor":"Spring","product":"Spring Integration","version":"affected 7.0.0 7.0.5 custom","platforms":[]},{"source":"CNA","vendor":"Spring","product":"Spring Integration","version":"affected 6.5.0 6.5.10 custom","platforms":[]},{"source":"CNA","vendor":"Spring","product":"Spring Integration","version":"affected 6.4.0 6.4.12 custom","platforms":[]},{"source":"CNA","vendor":"Spring","product":"Spring Integration","version":"affected 5.5.21 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Spring Integration","vendor":"Spring","versions":[{"status":"affected","version":"7.1.0","versionType":"custom"},{"lessThanOrEqual":"7.0.5","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThanOrEqual":"6.5.10","status":"affected","version":"6.5.0","versionType":"custom"},{"lessThanOrEqual":"6.4.12","status":"affected","version":"6.4.0","versionType":"custom"},{"lessThanOrEqual":"5.5.21","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.</p><p>Spring Integration 7.1.0<br/>Spring Integration 7.0.0 - 7.0.5<br/>Spring Integration 6.5.0 - 6.5.10<br/>Spring Integration 6.4.0 - 6.4.12<br/>Spring Integration 5.5.21 and earlier</p>"}],"value":"An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12\nSpring Integration 5.5.21 and earlier"}],"impacts":[{"descriptions":[{"lang":"en","value":"An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing."}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-26T23:49:25.980Z","orgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","shortName":"vmware"},"references":[{"url":"https://spring.io/security/cve-2026-47861"}],"source":{"discovery":"UNKNOWN"},"title":"UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false"}},"cveMetadata":{"assignerOrgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","assignerShortName":"vmware","cveId":"CVE-2026-47861","datePublished":"2026-08-26T23:49:25.980Z","dateReserved":"2026-05-20T10:00:55.156Z","dateUpdated":"2026-08-26T23:49:25.980Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-27 01:17:33","lastModifiedDate":"2026-08-27 01:17:33","problem_types":["CWE-918 Server-Side Request Forgery (SSRF)"],"metrics":{"cvssMetricV31":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"47861","Ordinal":"1","Title":"UDP adapter sends ack to attacker-supplied host:port parsed from","CVE":"CVE-2026-47861","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"47861","Ordinal":"1","NoteData":"An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12\nSpring Integration 5.5.21 and earlier","Type":"Description","Title":"UDP adapter sends ack to attacker-supplied host:port parsed from"}]}}}