PT-2026-35540 · Vmware · Spring Boot

Published 2026-04-27 · Updated 2026-06-03 · CVE-2026-40972

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Spring Boot versions 3.5.0 through 3.5.13 Spring Boot versions 3.4.0 through 3.4.15 Spring Boot versions 3.3.0 through 3.3.18 Spring Boot versions 2.7.0 through 2.7.32 Spring Boot versions prior to 2.7.0

Description An attacker on the same network as the remote application can use a timing attack—a method of discovering secrets by analyzing the time a system takes to respond to different inputs—to obtain information about the remote secret during DevTools remote secret comparison. In extreme cases, this could allow the attacker to determine the secret and upload modified classes, leading to remote code execution.

Recommendations Update to version 4.0.6 Update to version 3.5.14 Update to version 3.4.16 Update to version 3.3.19 Update to version 2.7.33

Fix

RCE

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-40972

GHSA-56V8-86GJ-66JP

Affected Products

Spring Boot

References · 12

• https://osv.dev/vulnerability/GHSA-56v8-86gj-66jp · Vendor Advisory
• https://spring.io/security/cve-2026-40972 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-40972 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40972 · Security Note
• https://github.com/spring-projects/spring-boot · Note
• https://twitter.com/CVEnew/status/2049350463603319125 · Twitter Post
• https://t.me/CVEtracker/51998 · Telegram Post
• https://twitter.com/CVEarity/status/2049003188788105220 · Twitter Post
• https://twitter.com/threatcluster/status/2048862413106114575 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049350941875355838 · Twitter Post
• https://t.me/cveNotify/161176 · Telegram Post
• https://twitter.com/CCBalert/status/2049164243509862496 · Twitter Post