CVE-2026-40973
Spring Boot accepts predictable temp directory without ownership verification
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40973- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
EUVDEUVD-2026-25937
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
EUVD-2026-25937- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wwpq-f5c3-7hvx
Spring Boot accepts predictable temp directory without ownership verification
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-wwpq-f5c3-7hvx- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
NVD
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40973- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
OSV
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40973- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
OSVGHSA-wwpq-f5c3-7hvx
Spring Boot accepts predictable temp directory without ownership verification
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-wwpq-f5c3-7hvx- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
Show 26 moreShow less
OSVRHLW-2026-196e0bd4df0804a6
Lightwell Security Advisory: spring-boot 2.7.18.rhlw-00004
Red Hat Lightwell has released org.springframework.boot:spring-boot 2.7.18.rhlw-00004 with backported fixes for CVE-2025-22235 and CVE-2026-40973.
CVE-2026-40973: A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
This patched artifact is a drop-in replacement for org.springframework.boot:spring-boot 2.7.18 from Maven Central.
- Record
RHLW-2026-196e0bd4df0804a6- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-40973
CVE-2026-40973 in org.springframework.boot:spring-boot - Patched by Root
Root has patched CVE-2026-40973 in the org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40973- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1779065187No score
TuxCare security update for org.springframework.boot:spring-boot (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot to address 1 CVE. Fixed in 2.7.18-tuxcare.14.
- Record
CLSA-2026-1779065187- Updated
- 2026-11-02
OSVCLSA-2026-1779410900No score
TuxCare security update for org.springframework.boot:spring-boot (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot to address 1 CVE. Fixed in 2.7.16-tuxcare.3.
- Record
CLSA-2026-1779410900- Updated
- 2026-11-02
OSVCLSA-2026-1779670114No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1779670114- Updated
- 2026-11-02
OSVCLSA-2026-1779842931No score
TuxCare security update for org.springframework.boot:spring-boot (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot to address 2 CVEs. Fixed in 2.6.15-tuxcare.11.
- Record
CLSA-2026-1779842931- Updated
- 2026-11-02
OSVCLSA-2026-1780879907No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.4.6-tuxcare.5.
- Record
CLSA-2026-1780879907- Updated
- 2026-11-02
OSVCLSA-2026-1781484852No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.2.
- Record
CLSA-2026-1781484852- Updated
- 2026-11-02
OSVCLSA-2026-1783558974No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.
- Record
CLSA-2026-1783558974- Updated
- 2026-11-02
OSVCLSA-2026-1783904634No score
TuxCare security update for org.springframework.boot (6 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 6 CVEs. Fixed in 2.5.15-tuxcare.1.
- Record
CLSA-2026-1783904634- Updated
- 2026-11-02
OSVCLSA-2026-1783991067No score
TuxCare security update for org.springframework.boot (9 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1783991067- Updated
- 2026-11-02
OSVCLSA-2026-1784164094No score
TuxCare security update for org.springframework.boot (7 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 7 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.5.
- Record
CLSA-2026-1784164094- Updated
- 2026-11-02
OSVCLSA-2026-1787144370No score
TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.
- Record
CLSA-2026-1787144370- Updated
- 2026-11-02
OSVCLSA-2026-1787144963No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.
- Record
CLSA-2026-1787144963- Updated
- 2026-11-02
OSVCLSA-2026-1787145317No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.
- Record
CLSA-2026-1787145317- Updated
- 2026-11-02
OSVCLSA-2026-1788194802No score
TuxCare security update for org.springframework.data:spring-data-commons (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788194802- Updated
- 2026-11-02
OSVCLSA-2026-1788421913No score
TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788421913- Updated
- 2026-11-02
OSVCLSA-2026-1788421934No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788421934- Updated
- 2026-11-02
OSVCLSA-2026-1788422044No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788422044- Updated
- 2026-11-02
OSVCLSA-2026-1788422148No score
TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788422148- Updated
- 2026-11-02
OSVCLSA-2026-1788428259No score
TuxCare security update for org.springframework.data:spring-data-redis (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-redis to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788428259- Updated
- 2026-11-02
OSVCLSA-2026-1793299405No score
TuxCare security update for org.springframework.boot (8 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.9-tuxcare.1.
- Record
CLSA-2026-1793299405- Updated
- 2026-11-02
OSVCLSA-2026-1793801974No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 2 CVEs. Fixed in 2.7.8-tuxcare.2.
- Record
CLSA-2026-1793801974- Updated
- 2026-11-04
OSVCLSA-2026-1794195758No score
TuxCare security update for org.springframework.boot (10 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 10 CVEs. Fixed in 2.0.3.RELEASE-tuxcare.1.
- Record
CLSA-2026-1794195758- Updated
- 2026-11-09
OSVCLSA-2026-1794255922No score
TuxCare security update for org.springframework.boot (8 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.15-tuxcare.2.
- Record
CLSA-2026-1794255922- Updated
- 2026-11-10
OSVCLSA-2026-1794275759No score
TuxCare security update for org.springframework.boot (7 CVEs)
TuxCare rebuilt 5 org.springframework.boot packages to address 7 CVEs. Fixed in 2.1.18.RELEASE-tuxcare.1.
- Record
CLSA-2026-1794275759- Updated
- 2026-11-10
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-bootMaven | 4.0.0 up to 4.0.6 | 4.0.6 |
org.springframework.boot:spring-bootMaven | 3.5.0 up to 3.5.14 | 3.5.14 |
org.springframework.boot:spring-bootMaven | 3.4.0 to 3.4.15 | None known |
org.springframework.boot:spring-bootMaven | 3.3.0 to 3.3.18 | None known |
org.springframework.boot:spring-bootMaven | through 2.7.32 | None known |
org.springframework.boot:spring-bootTuxCare:Maven | 2.7.18 up to 2.7.18-tuxcare.14, plus listed versions 2.7.18-tuxcare.102.7.18-tuxcare.112.7.18-tuxcare.122.7.18-tuxcare.132.7.18-tuxcare.8 Show 8 moreShow less2.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.32.7.18.tuxcare.42.7.18.tuxcare.52.7.18.tuxcare.62.7.18.tuxcare.7 | 2.7.18-tuxcare.14 |
org.springframework.boot:spring-bootTuxCare:Maven | 2.7.16 up to 2.7.16-tuxcare.3, plus listed versions 2.7.16-tuxcare.12.7.16-tuxcare.2 | 2.7.16-tuxcare.3 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs | 3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 | 3.3.13-tuxcare.4 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs | 3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 | 3.3.13-tuxcare.4 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 4 CVEs | 3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 | 3.3.13-tuxcare.4 |
Show 61 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs | 2.6.15 up to 2.6.15-tuxcare.11, plus listed versions 2.6.15-tuxcare.102.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.42.6.15-tuxcare.5 Show 5 moreShow less2.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15-tuxcare.92.6.15.tuxcare.1 | 2.6.15-tuxcare.11 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs | 2.4.6 up to 2.4.6-tuxcare.5, plus listed versions 2.4.6-tuxcare.32.4.6-tuxcare.42.4.6.tuxcare.2 | 2.4.6-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs | 2.4.6 up to 2.4.6-tuxcare.5, plus listed versions 2.4.6-tuxcare.32.4.6-tuxcare.42.4.6.tuxcare.2 | 2.4.6-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs | 2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 | 2.4.5-tuxcare.2 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 4 CVEs | 2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 | 2.4.5-tuxcare.2 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs | 3.4.13 up to 3.4.13-tuxcare.1 | 3.4.13-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs | 3.4.13 up to 3.4.13-tuxcare.1 | 3.4.13-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 4 CVEs | 3.4.13 up to 3.4.13-tuxcare.1 | 3.4.13-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 4 CVEs | 3.4.13 up to 3.4.13-tuxcare.1 | 3.4.13-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 6 CVEs | 2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 6 CVEs | 2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 6 CVEs | 2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 6 CVEs | 2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 6 CVEs | 2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 6 CVEs | 2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 9 CVEs | 2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 9 CVEs | 2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs | 2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs | 2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 9 CVEs | 2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 9 CVEs | 2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 9 CVEs | 2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 7 CVEs | 2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 | 2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs | 2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 | 2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs | 2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 | 2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 7 CVEs | 2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 | 2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 8 CVEs | 2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 8 CVEs | 2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs | 2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs | 2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 8 CVEs | 2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 8 CVEs | 2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 8 CVEs | 2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs | 2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 | 2.7.8-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs | 2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 | 2.7.8-tuxcare.2 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 2 CVEs | 2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 | 2.7.8-tuxcare.2 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 10 CVEs | 2.0.3.RELEASE up to 2.0.3.RELEASE-tuxcare.1 | 2.0.3.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 10 CVEs | 2.0.3.RELEASE up to 2.0.3.RELEASE-tuxcare.1 | 2.0.3.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 10 CVEs | 2.0.3.RELEASE up to 2.0.3.RELEASE-tuxcare.1 | 2.0.3.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 10 CVEs | 2.0.3.RELEASE up to 2.0.3.RELEASE-tuxcare.1 | 2.0.3.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 10 CVEs | 2.0.3.RELEASE up to 2.0.3.RELEASE-tuxcare.1 | 2.0.3.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 10 CVEs | 2.0.3.RELEASE up to 2.0.3.RELEASE-tuxcare.1 | 2.0.3.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 8 CVEs | 2.7.15 up to 2.7.15-tuxcare.2, plus listed versions 2.7.15-tuxcare.1 | 2.7.15-tuxcare.2 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 8 CVEs | 2.7.15 up to 2.7.15-tuxcare.2, plus listed versions 2.7.15-tuxcare.1 | 2.7.15-tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs | 2.7.15 up to 2.7.15-tuxcare.2, plus listed versions 2.7.15-tuxcare.1 | 2.7.15-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs | 2.7.15 up to 2.7.15-tuxcare.2, plus listed versions 2.7.15-tuxcare.1 | 2.7.15-tuxcare.2 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 8 CVEs | 2.7.15 up to 2.7.15-tuxcare.2, plus listed versions 2.7.15-tuxcare.1 | 2.7.15-tuxcare.2 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 8 CVEs | 2.7.15 up to 2.7.15-tuxcare.2, plus listed versions 2.7.15-tuxcare.1 | 2.7.15-tuxcare.2 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 7 CVEs | 2.1.18.RELEASE up to 2.1.18.RELEASE-tuxcare.1 | 2.1.18.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 7 CVEs | 2.1.18.RELEASE up to 2.1.18.RELEASE-tuxcare.1 | 2.1.18.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs | 2.1.18.RELEASE up to 2.1.18.RELEASE-tuxcare.1 | 2.1.18.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 7 CVEs | 2.1.18.RELEASE up to 2.1.18.RELEASE-tuxcare.1 | 2.1.18.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 7 CVEs | 2.1.18.RELEASE up to 2.1.18.RELEASE-tuxcare.1 | 2.1.18.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootMaven | 4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 | 4.0.6 |
org.springframework.boot:spring-bootMaven | 3.5.0 up to 3.5.14, plus listed versions 3.5.13.5.103.5.113.5.123.5.13 Show 8 moreShow less3.5.23.5.33.5.43.5.53.5.63.5.73.5.83.5.9 | 3.5.14 |
org.springframework.boot:spring-bootMaven | 3.4.0 to 3.4.15, plus listed versions 3.4.13.4.103.4.113.4.123.4.13 Show 8 moreShow less3.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9 | None known |
org.springframework.boot:spring-bootMaven | 3.3.0 to 3.3.18, plus listed versions 3.3.13.3.103.3.113.3.123.3.13 Show 8 moreShow less3.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.9 | None known |
org.springframework.boot:spring-bootMaven | through 2.7.32, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE | None known |
org.springframework.boot:spring-bootRed Hat Lightwell:Maven From an advisory covering 2 CVEs | before 2.7.18.rhlw-00004, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE | 2.7.18.rhlw-00004 |
org.springframework.boot:spring-bootRoot:Maven | before 2.7.11-aikido.2 | 2.7.11-aikido.22.7.11-aikido.13.5.12-aikido.23.4.5-aikido.13.3.4-aikido.33.4.2-aikido.33.4.4-aikido.73.5.13-aikido.24.0.5-aikido.24.0.5-aikido.33.5.12-aikido.14.0.6-aikido.1 |
io.root.org.springframework.boot:spring-bootRoot:Maven | before 2.7.11-root.io.2 | 2.7.11-root.io.24.0.5-root.io.13.4.4-root.io.43.4.2-root.io.13.5.13-root.io.13.4.2-root.io.23.4.4-root.io.53.4.4-root.io.63.3.4-root.io.13.3.4-root.io.23.5.12-root.io.22.7.11-root.io.13.4.5-root.io.13.3.4-root.io.33.4.2-root.io.33.4.4-root.io.73.5.13-root.io.24.0.5-root.io.24.0.5-root.io.33.5.12-root.io.14.0.6-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected | ||
| affected, aliases, facts | OSV | |
| affected | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40973 is a high vulnerability (CVSS 7.0) in Spring Boot, published April 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in org.springframework.boot:spring-boot 4.0.6.
References
Left out here: 272 versions. The JSON record has them.