CVE-2026-40972highCWE-208

CVE-2026-40972: falha de alta gravidade em Spring Boot

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring Boot+ Monitorar org.springframework.boot:spring-boot-devtools

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.3%
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Spring · Spring Boot
CVEs relacionadas — Spring Boot

No mesmo produto, das mais perigosas para as menos.

CVE-2023-34055MEDIUMSpring Boot server Web Observations DoS VulnerabilityEPSS 1.2%CVE-2019-3797LOWAdditional information exposure with Spring Data JPA derived queriesEPSS 1.1%CVE-2026-40976CRITICALCVE-2026-40976EPSS 0.5%CVE-2025-22235HIGHSpring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedEPSS 0.4%CVE-2026-22731HIGHAuthentication Bypass under Actuator Health groups pathsEPSS 0.3%CVE-2026-40975MEDIUMCVE-2026-40975EPSS 0.3%