PT-2026-35547 · Vmware · Spring Boot

Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-40975

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Spring Boot versions 3.5.0 through 3.5.13 Spring Boot versions 3.4.0 through 3.4.16 Spring Boot versions 3.3.0 through 3.3.18 Spring Boot versions 2.7.0 through 2.7.32 Spring Boot versions prior to 2.7.0

Description Weak Pseudo-Random Number Generation (PRNG) occurs when values produced by ${random.value} are used as secrets. Specifically, ${random.int} and ${random.long} are unsuitable for secrets because they are numeric values with a predictable range. PRNG is an algorithm for generating a sequence of numbers whose properties approximate the properties of sequences of random numbers.

Recommendations Update to version 4.0.6 Update to version 3.5.14 Update to version 3.4.16 Update to version 3.3.19 Update to version 2.7.33 Avoid using ${random.int} and ${random.long} for secrets.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2026-40975

GHSA-M4X9-HX6X-2C43

Affected Products

Spring Boot

References · 7

• https://osv.dev/vulnerability/GHSA-m4x9-hx6x-2c43 · Vendor Advisory
• https://spring.io/security/cve-2026-40975 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40975 · Security Note
• https://github.com/spring-projects/spring-boot · Note
• https://twitter.com/CVEarity/status/2049018966933373304 · Twitter Post
• https://t.me/CVEtracker/52001 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2049085884239106428 · Twitter Post