Spring Spring Boot
13 CVEs affecting Spring Spring Boot. Latest disclosed: 2026-04-28. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40976 | Critical | 9.1 | 2026-04-28 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable… |
CVE-2026-22731 | High | 8.2 | 2026-03-19 | Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication… |
CVE-2026-40972 | High | 7.5 | 2026-04-28 | An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme ci… |
CVE-2025-22235 | High | 7.3 | 2025-04-28 | EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your… |
CVE-2026-40973 | High | 7.0 | 2026-04-28 | A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persi… |
CVE-2024-38807 | Medium | 6.3 | 2024-08-23 | Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be… |
CVE-2023-34055 | Medium | 5.3 | 2023-11-28 | In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a den… |
CVE-2026-40974 | Medium | 5.0 | 2026-04-28 | Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0… |
CVE-2026-40971 | Medium | 5.0 | 2026-04-27 | When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. … |
CVE-2026-40970 | Medium | 5.0 | 2026-04-27 | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearc… |
CVE-2026-40975 | Medium | 4.8 | 2026-04-28 | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used f… |
CVE-2026-40977 | Medium | 4.7 | 2026-04-28 | When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the… |
CVE-2019-3797 | Low | 3.5 | 2019-05-06 | This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith… |