--- title: UDP adapter sends ack to attacker-supplied host:port... description: A security advisory describes a vulnerability in Spring's UDP adapter where the acknowledgment destination host and port are parsed directly from the incoming... canonical: https://daily.dev/posts/udp-adapter-sends-ack-to-attacker-supplied-host-port-parsed-from-packet-body-even-when-acknowledge--pewaoyuwk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false | daily.dev og:description: A security advisory describes a vulnerability in Spring's UDP adapter where the acknowledgment destination host and port are parsed directly from the incoming... og:url: https://daily.dev/posts/udp-adapter-sends-ack-to-attacker-supplied-host-port-parsed-from-packet-body-even-when-acknowledge--pewaoyuwk og:image: https://api.daily.dev/og/posts/pEWaoYuwK.png og:image:alt: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false **[Spring](https://daily.dev/sources/spring)** · 1 min read · 3 upvotes · 0 comments ## Summary A security advisory describes a vulnerability in Spring's UDP adapter where the acknowledgment destination host and port are parsed directly from the incoming packet body and used to send an ack, even when the acknowledge flag is set to false. This allows an attacker to control where acknowledgments are sent, potentially enabling abuse such as reflection or unwanted network traffic to arbitrary hosts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the issue with Spring's UDP adapter and acknowledgment packets? Spring's UDP adapter parses the destination host and port for acknowledgment packets directly from the body of the incoming UDP packet, and it sends that acknowledgment even when the acknowledge option is set to false. This lets an attacker supply an arbitrary host:port in the packet and have the adapter send traffic there regardless of configuration, tracked as a security vulnerability. _Teams running Spring Integration UDP components can track patch details for this flaw on daily.dev._ ## Similar posts on daily.dev - [Defending QUIC from acknowledgement-based DDoS attacks](https://daily.dev/posts/defending-quic-from-acknowledgement-based-ddos-attacks-1fnmwhvvy) · Cloudflare · 1 upvotes · 0 comments - [Unbounded memory allocation in RFC6587SyslogDeserializer \(octet-counted framing\) — remote DoS](https://daily.dev/posts/unbounded-memory-allocation-in-rfc6587syslogdeserializer-octet-counted-framing-remote-dos-fktfnzmbj) · Spring · 2 upvotes · 0 comments - [In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages](https://daily.dev/posts/in-spring-for-apache-kafka-ssrf-via-dns-resolution-triggered-by-untrusted-java-net-types-in-header--mk0ygsrfq) · Spring · 1 upvotes · 0 comments - [Worth Reading: NatJack « ipSpace.net blog](https://daily.dev/posts/worth-reading-natjack-ipspace-net-blog-d5hubg7yu) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#spring](https://daily.dev/tags/spring) [View this post on daily.dev](https://daily.dev/posts/udp-adapter-sends-ack-to-attacker-supplied-host-port-parsed-from-packet-body-even-when-acknowledge--pewaoyuwk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false","url":"https://daily.dev/posts/udp-adapter-sends-ack-to-attacker-supplied-host-port-parsed-from-packet-body-even-when-acknowledge--pewaoyuwk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/udp-adapter-sends-ack-to-attacker-supplied-host-port-parsed-from-packet-body-even-when-acknowledge--pewaoyuwk"},"datePublished":"2026-08-20T16:42:37.012Z","dateModified":"2026-09-13T19:20:30.392Z","description":"A security advisory describes a vulnerability in Spring's UDP adapter where the acknowledgment destination host and port are parsed directly from the incoming...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff749d548af41095da8724da8d7ba5f9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff749d548af41095da8724da8d7ba5f9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Spring","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Spring","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/spring","url":"https://daily.dev/sources/spring"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/udp-adapter-sends-ack-to-attacker-supplied-host-port-parsed-from-packet-body-even-when-acknowledge--pewaoyuwk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,spring","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Spring","item":"https://daily.dev/sources/spring"},{"@type":"ListItem","position":3,"name":"UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/udp-adapter-sends-ack-to-attacker-supplied-host-port-parsed-from-packet-body-even-when-acknowledge--pewaoyuwk#faq","mainEntity":[{"@type":"Question","name":"What is the issue with Spring's UDP adapter and acknowledgment packets?","acceptedAnswer":{"@type":"Answer","text":"Spring's UDP adapter parses the destination host and port for acknowledgment packets directly from the body of the incoming UDP packet, and it sends that acknowledgment even when the acknowledge option is set to false. This lets an attacker supply an arbitrary host:port in the packet and have the adapter send traffic there regardless of configuration, tracked as a security vulnerability. Teams running Spring Integration UDP components can track patch details for this flaw on daily.dev."}}]} ```