CVE-2026-40972
Last modified
CVE-2026-40972 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
Metrics
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Boot | < 2.7.33 |
| Vmware | Spring Boot | >= 3.3.0, < 3.3.19 |
| Vmware | Spring Boot | >= 3.4.0, < 3.4.16 |
| Vmware | Spring Boot | >= 3.5.0, < 3.5.14 |
| Vmware | Spring Boot | >= 4.0.0, < 4.0.6 |
References
- https://spring.io/security/cve-2026-40972Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-40972?
How severe is CVE-2026-40972?
How do I fix CVE-2026-40972?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-40966In Spring AI, an attacker can bypass conversation isolation …5.9
- CVE-2026-40967In Spring AI, various FilterExpressionConverter implementati…8.6
- CVE-2026-40968When an authenticated user is denied access to a gRPC method…8.8
- CVE-2026-40969The raw message of every server-side AuthenticationException…5.3
- CVE-2026-40970When configured to use an SSL bundle, Spring Boot's Elastics…6.8
- CVE-2026-40971When configured to use an SSL bundle, Spring Boot's RabbitMQ…9.1
- CVE-2026-40973A local attacker on the same host as the application may be …7
- CVE-2026-40974Spring Boot's Cassandra auto-configuration does not perform …9.8
- CVE-2026-40975Values produced by ${random.value} are not suitable for use …7.5
- CVE-2026-40976In certain circumstances, Spring Boot's default web security…9.1
- CVE-2026-40977When an application is configured to use `ApplicationPidFile…6.7
- CVE-2026-40978SQL injection vulnerability in Spring AI's `CosmosDBVectorSt…8.8
Are you affected by CVE-2026-40972?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST