An unauthenticated remote attacker can send a single UDP packet to a Spring Integration UDP inbound adapter. The server then emits an outbound UDP datagram to any host and port specified in the packet body, even when acknowledgment is disabled. This enables the attacker to compel the server to transmit traffic to arbitrary destinations, allowing potential data exfiltration, denial‑of‑service by flooding external hosts, or establishing covert communication channels. The flaw is rooted in improper validation of the target address supplied by the attacker, a classic case of insufficient input filtering before network transmission.

The flaw affects Spring Integration products from version 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. All affected releases are distributed by the Spring vendor and can be identified by the CNA entry "Spring:Spring Integration".

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack requires only the ability to send a UDP packet to the inbound adapter and does not require authentication, making it trivial to exploit from any network that can reach the target. Because the flaw orchestrates outbound traffic, it can be leveraged for exfiltration or disruption even while the system’s internal state remains unchanged. The lack of a required user interaction or complex setup elevates the practical risk of exploitation.