GHSA-c96x-rpm4-349p

Source

https://github.com/advisories/GHSA-c96x-rpm4-349p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c96x-rpm4-349p/GHSA-c96x-rpm4-349p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c96x-rpm4-349p

Aliases

CVE-2026-40970

Published

2026-04-27T21:31:02Z

Modified

2026-05-06T18:48:51.703321Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.

Details

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.

Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Database specific

{
    "cwe_ids": [
        "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T18:38:23Z",
    "nvd_published_at": "2026-04-27T19:16:52Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.springframework.boot:spring-boot-elasticsearch

Package

Name: org.springframework.boot:spring-boot-elasticsearch; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.boot/spring-boot-elasticsearch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.0.6

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-c96x-rpm4-349p/GHSA-c96x-rpm4-349p.json"