Spring Boot vulnerabilities

CVE-2026-40976 [CRITICAL] CWE-862 CVE-2026-40976: In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized ac In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure

CVE-2026-22731 [HIGH] CWE-288 CVE-2026-22731: Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. T

CVE-2026-40974 [CRITICAL] CWE-295 CVE-2026-40974: Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer

CVE-2026-40971 [CRITICAL] CWE-295 CVE-2026-40971: When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hos When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.

CVE-2026-40972 [HIGH] CWE-208 CVE-2026-40972: An attacker on the same network as the remote application may be able to utilize a timing attack to An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0

CVE-2026-40975 [HIGH] CWE-330 CVE-2026-40975: Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affect Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2

CVE-2025-22235 [HIGH] CWE-20 CVE-2025-22235: EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointR EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your application may be affected by this if all the following conditions are met: * You use Spring Security * EndpointRequest.to() has been used in a Spring Security chain configuration * The endpoin

CVE-2026-40973 [HIGH] CWE-377 CVE-2026-40973: A local attacker on the same host as the application may be able to take control of the directory us A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and e

CVE-2026-40977 [MEDIUM] CWE-59 CVE-2026-40977: When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write acc When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7

CVE-2023-34055 [MEDIUM] CVE-2023-34055: In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to p In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable when all of the following are true: * the application uses Spring MVC or Spring WebFlux * org.springframework.boot:spring-b

CVE-2026-40970 [MEDIUM] CWE-295 CVE-2026-40970: When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perfor When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

CVE-2024-38807 [MEDIUM] CWE-290 CVE-2024-38807: Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.

CVE-2019-3797 [MEDIUM] CWE-89 CVE-2019-3797: This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived quer This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpect

CVE-2026-41001 [MEDIUM] CWE-377 CVE-2026-41001: Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.

CVE-2026-40992 [MEDIUM] CWE-295 CVE-2026-40992: Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set t Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.