CVE-2026-40972

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40972
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40972.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40972
Aliases
Downstream
Published
2026-04-27T23:15:19.194Z
Modified
2026-07-15T01:49:11.400416248Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40972.json",
    "cna_assigner": "vmware",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.0.6"
                },
                {
                    "introduced": "3.5.0"
                },
                {
                    "fixed": "3.5.14"
                },
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.16"
                },
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.3.19"
                },
                {
                    "introduced": "2.7.0"
                },
                {
                    "fixed": "2.7.33"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-208"
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-boot

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-boot
Events
Introduced
8c2d6453243f319accaef7a190ff8ddf89f482a2
Fixed
7d7b3ac12735161f9c096ce6cb415bdd9fc4a0f4
Introduced
1c0e08b4c434b0e77a83098267b2a0f5a3fc56d7
Fixed
8821ad2cd381bb4b9615a61479e1de7305a8ba39
Database specific 
{
    "cpe": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.14"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.6"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40972.json"