CVE-2026-40974
Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40974- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2026-25938
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
- Record
EUVD-2026-25938- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mqvw-jfmh-93qq
Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-mqvw-jfmh-93qq- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40974- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40974- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVGHSA-mqvw-jfmh-93qq
Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-mqvw-jfmh-93qq- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
Show 15 moreShow less
OSVCLSA-2026-1780361412 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 3.3.13-tuxcare.5.
- Record
CLSA-2026-1780361412- Updated
- 2026-11-02
OSVCLSA-2026-1780879907 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.4.6-tuxcare.5.
- Record
CLSA-2026-1780879907- Updated
- 2026-11-02
OSVCLSA-2026-1781484853 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 2.7.18-tuxcare.17.
- Record
CLSA-2026-1781484853- Updated
- 2026-11-02
OSVCLSA-2026-1783040468 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 2.7.16-tuxcare.7.
- Record
CLSA-2026-1783040468- Updated
- 2026-11-02
OSVCLSA-2026-1783645377 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 2 CVEs. Fixed in 2.4.5-tuxcare.4.
- Record
CLSA-2026-1783645377- Updated
- 2026-11-02
OSVCLSA-2026-1784164094 No score
TuxCare security update for org.springframework.boot (7 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 7 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.5.
- Record
CLSA-2026-1784164094- Updated
- 2026-11-02
OSVCLSA-2026-1784596267 No score
TuxCare security update for org.springframework.boot:spring-boot-autoconfigure (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot-autoconfigure to address 1 CVE. Fixed in 2.6.15-tuxcare.14.
- Record
CLSA-2026-1784596267- Updated
- 2026-11-02
OSVCLSA-2026-1788420664 No score
TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.5.
- Record
CLSA-2026-1788420664- Updated
- 2026-11-02
OSVCLSA-2026-1789285402 No score
TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.3.13-tuxcare.5.
- Record
CLSA-2026-1789285402- Updated
- 2026-11-02
OSVCLSA-2026-1789285409 No score
TuxCare security update for org.springframework.data:spring-data-ldap (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 1 CVE. Fixed in 3.3.13-tuxcare.5.
- Record
CLSA-2026-1789285409- Updated
- 2026-11-02
OSVCLSA-2026-1789285864 No score
TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 4 org.springframework.data packages to address 1 CVE. Fixed in 3.3.13-tuxcare.5.
- Record
CLSA-2026-1789285864- Updated
- 2026-11-02
OSVCLSA-2026-1789286115 No score
TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 5 org.springframework.data packages to address 1 CVE. Fixed in 3.3.13-tuxcare.5.
- Record
CLSA-2026-1789286115- Updated
- 2026-11-02
OSVCLSA-2026-1789288364 No score
TuxCare security update for org.springframework.data:spring-data-redis (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-redis to address 1 CVE. Fixed in 3.3.13-tuxcare.5.
- Record
CLSA-2026-1789288364- Updated
- 2026-11-02
OSVCLSA-2026-1793015923 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.5.
- Record
CLSA-2026-1793015923- Updated
- 2026-11-02
OSVCLSA-2026-1793299405 No score
TuxCare security update for org.springframework.boot (8 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.9-tuxcare.1.
- Record
CLSA-2026-1793299405- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-cassandraMaven |
4.0.0 up to 4.0.6 | 4.0.6 |
org.springframework.boot:spring-boot-cassandraMaven |
3.5.0 up to 3.5.14 | 3.5.14 |
org.springframework.boot:spring-boot-cassandraMaven |
3.4.0 to 3.4.15 | None known |
org.springframework.boot:spring-boot-cassandraMaven |
3.3.0 to 3.3.18 | None known |
org.springframework.boot:spring-boot-cassandraMaven |
through 2.7.32 | None known |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
3.3.13 up to 3.3.13-tuxcare.5, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.33.3.13-tuxcare.4 |
3.3.13-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.4.6 up to 2.4.6-tuxcare.5, plus listed versions 2.4.6-tuxcare.32.4.6-tuxcare.42.4.6.tuxcare.2 |
2.4.6-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
2.4.6 up to 2.4.6-tuxcare.5, plus listed versions 2.4.6-tuxcare.32.4.6-tuxcare.42.4.6.tuxcare.2 |
2.4.6-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.7.18 up to 2.7.18-tuxcare.17, plus listed versions 2.7.18-tuxcare.102.7.18-tuxcare.112.7.18-tuxcare.122.7.18-tuxcare.132.7.18-tuxcare.14 Show 11 moreShow less2.7.18-tuxcare.152.7.18-tuxcare.162.7.18-tuxcare.82.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.32.7.18.tuxcare.42.7.18.tuxcare.52.7.18.tuxcare.62.7.18.tuxcare.7 |
2.7.18-tuxcare.17 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.7.16 up to 2.7.16-tuxcare.7, plus listed versions 2.7.16-tuxcare.12.7.16-tuxcare.22.7.16-tuxcare.32.7.16-tuxcare.42.7.16-tuxcare.52.7.16-tuxcare.6 |
2.7.16-tuxcare.7 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
2.4.5 up to 2.4.5-tuxcare.4, plus listed versions 2.4.5-tuxcare.12.4.5-tuxcare.22.4.5-tuxcare.3 |
2.4.5-tuxcare.4 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven |
2.6.15 up to 2.6.15-tuxcare.14, plus listed versions 2.6.15-tuxcare.102.6.15-tuxcare.112.6.15-tuxcare.122.6.15-tuxcare.132.6.15-tuxcare.2 Show 8 moreShow less2.6.15-tuxcare.32.6.15-tuxcare.42.6.15-tuxcare.52.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15-tuxcare.92.6.15.tuxcare.1 |
2.6.15-tuxcare.14 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
3.2.12 up to 3.2.12-tuxcare.5, plus listed versions 3.2.12-tuxcare.13.2.12-tuxcare.23.2.12-tuxcare.33.2.12-tuxcare.4 |
3.2.12-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
3.2.12 up to 3.2.12-tuxcare.5, plus listed versions 3.2.12-tuxcare.13.2.12-tuxcare.23.2.12-tuxcare.33.2.12-tuxcare.4 |
3.2.12-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-cassandraMaven |
4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 |
4.0.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40974 is a medium vulnerability (CVSS 5.0) in Spring Boot, published April 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in org.springframework.boot:spring-boot-cassandra 4.0.6.