PT-2026-35549 · Vmware · Spring Boot

Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-40977

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Spring Boot versions 3.5.0 through 3.5.13 Spring Boot versions 3.4.0 through 3.4.15 Spring Boot versions 3.3.0 through 3.3.18 Spring Boot versions 2.7.0 through 2.7.32 Spring Boot versions prior to 2.7.0

Description When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. This issue relates to the symlink behavior of the ApplicationPidFileWriter component.

Recommendations Update to version 4.0.6 Update to version 3.5.14 Update to version 3.4.16 Update to version 3.3.19 Update to version 2.7.33 As a temporary workaround, restrict write access to the PID file's location or avoid using the ApplicationPidFileWriter component.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-40977

GHSA-5368-6H4H-GR29

Affected Products

Spring Boot

References · 6

• https://spring.io/security/cve-2026-40977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40977 · Security Note
• https://osv.dev/vulnerability/GHSA-5368-6h4h-gr29 · Vendor Advisory
• https://github.com/spring-projects/spring-boot · Note
• https://twitter.com/CVEarity/status/2049024524646334669 · Twitter Post
• https://t.me/CVEtracker/52003 · Telegram Post