Skip to content
fr Sign in
7.5 High

CVE-2026-40972 An attacker on the same network as the remote application may be able to utilize a timing attack to discover information…

Description

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

Affected products and versions

Product Affected versions Fixed in
Spring Boot 4.0 4.0.0 → < 4.0.6 4.0.6
Spring Boot 3.5 3.5.0 → < 3.5.14 3.5.14
Spring Boot 3.4 3.4.0 → < 3.4.16 3.4.16
Spring Boot 3.3 3.3.0 → < 3.3.19 3.3.19
Spring Boot 2.7 2.7.0 → < 2.7.33 2.7.33

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Boot

The 15 CVEs of Spring Boot →
CVE-2026-41001 Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's… 5.3 Medium CVE-2026-40992 Spring Boot's Mail auto-configuration does not enable hostname verification 5.0 Medium CVE-2026-40977 When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID… 4.7 Medium CVE-2026-40976 In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all… 9.1 Critical
Track this CVE