Spring Boot (Spring) - vulnerabilities (CVEs)
15 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-06-11. Vendor: Spring.
CVEs of Spring Boot
- CVE-2026-41001 - CVSS 5.3 (medium), 2026-06-11: Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is…
- CVE-2026-40992 - CVSS 5 (medium), 2026-06-11: Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as…
- CVE-2026-40975 - CVSS 8.2 (high), 2026-04-28: Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used…
- CVE-2026-40974 - CVSS 9.8 (critical), 2026-04-28: Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot…
- CVE-2026-40977 - CVSS 6.7 (medium), 2026-04-28: When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the…
- CVE-2026-40973 - CVSS 7 (high), 2026-04-28: A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When…
- CVE-2026-40976 - CVSS 9.1 (critical), 2026-04-28: In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be…
- CVE-2026-40972 - CVSS 7.5 (high), 2026-04-28: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme…
- CVE-2026-40971 - CVSS 9.1 (critical), 2026-04-27: When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.…
- CVE-2026-40970 - CVSS 6.8 (medium), 2026-04-27: When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the…
- CVE-2026-22731 - CVSS 8.2 (high), 2026-03-19: Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication…
- CVE-2025-22235 - CVSS 7.3 (high), 2025-04-28: EndpointRequest.to() creates a matcher for null/** if the actuator endpoint, for which the EndpointRequest has been created, is disabled or not exposed. Your…
- CVE-2024-38807 - CVSS 6.3 (medium), 2024-08-23: Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be…
- CVE-2023-34055 - CVSS 6.5 (medium), 2023-11-28: In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a…
- CVE-2019-3797 - CVSS 5.3 (medium), 2019-05-06: This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’,…
