CVE-2024-38807: medium-severity vulnerability in Spring Boot
CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.1%
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Spring · Spring BootRelated CVEs — Spring Boot
In the same product, most dangerous first.
CVE-2023-34055MEDIUMSpring Boot server Web Observations DoS VulnerabilityEPSS 1.2%CVE-2019-3797LOWAdditional information exposure with Spring Data JPA derived queriesEPSS 1.1%CVE-2026-40976CRITICALCVE-2026-40976EPSS 0.5%CVE-2025-22235HIGHSpring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedEPSS 0.4%CVE-2026-22731HIGHAuthentication Bypass under Actuator Health groups pathsEPSS 0.3%CVE-2026-40975MEDIUMCVE-2026-40975EPSS 0.3%