Spring Spring Boot
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-41001 | 4.0.0 – < 4.0.6.1 ; 3.5.0 – < 3.5.14.1 ; 3.4.0 – < 3.4.17 ; … | Predictable Temp Directory in Artemis Auto-configuration | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-40992 | 4.0.0 – < 4.0.6.1 ; 3.5.0 – < 3.5.14.1 ; 3.4.0 – < 3.4.17 | Mail Auto-Configuration Does Not Enable SSL Hostname Verification | MEDIUM 5.0 | 0.1 % | ||
| CVE-2026-40977 | 4.0.0 – < 4.0.6 ; 3.5.0 – < 3.5.14 ; 3.4.0 – < 3.4.16 ; … | When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corru | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-40976 | 4.0.0 – < 4.0.6 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an applicatio | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-40975 | 4.0.0 – < 4.0.6 ; 3.5.0 – < 3.5.14 ; 3.4.0 – < 3.4.16 ; … | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} sho | HIGH 7.5 | 0.3 % | ||
| CVE-2026-40974 | 4.0.0 – < 4.0.6 ; 3.5.0 – < 3.5.14 ; 3.4.0 – < 3.4.16 ; … | Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affecte | CRITICAL 9.8 | 0.2 % | ||
| CVE-2026-40973 | 4.0.0 – < 4.0.6 ; 3.5.0 – < 3.5.14 ; 3.4.0 – < 3.4.16 ; … | A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.se | HIGH 7.0 | 0.1 % | ||
| CVE-2026-40972 | 4.0.0 – < 4.0.6 ; 3.5.0 – < 3.5.14 ; 3.4.0 – < 3.4.16 ; … | An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote se | HIGH 7.5 | 0.3 % | ||
| CVE-2026-40971 | 4.0.0 – < 4.0.6 ; 3.5.0 – < 3.5.14 | When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to th | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-40970 | 4.0.0 – < 4.0.6 | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-22731 | 4.0 – < 4.0.3 ; 3.5 – < 3.5.11 ; 3.4 – < 3.4.15 | Authentication Bypass under Actuator Health groups paths | HIGH 8.2 | 0.3 % | ||
| CVE-2025-22235 | 2.7.x – < 2.7.25 ; 3.1.x – < 3.1.16 ; 3.2.x – < 3.2.14 ; … | Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed | HIGH 7.3 | 0.4 % | ||
| CVE-2024-38807 | 2.7.x – < 2.7.22 ; 3.0.x – < 3.0.17 ; 3.1.x – < 3.1.13 ; … | CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader | MEDIUM 6.3 | 0.1 % | ||
| CVE-2023-34055 | 2.7.0 – < 2.7.18 ; 3.0.0 – < 3.0.13 ; 3.1.0 – < 3.1.6 ; … | Spring Boot server Web Observations DoS Vulnerability | MEDIUM 6.5 | 1.2 % | ||
| CVE-2019-3797 | 2.0 – < v2.0.9.RELEASE ; 1.5 – < v1.5.20.RELEASE ; 2.1 – < v2.1.4.RELEASE | Additional information exposure with Spring Data JPA derived queries | MEDIUM 5.3 | 1.1 % |