CVE-2026-40975
Spring Boot's random value property source uses a weak PRNG unsuitable for secrets
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40975- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-330, CWE-338
- Updated
- 2026-11-02
EUVDEUVD-2026-25939
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
- Record
EUVD-2026-25939- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m4x9-hx6x-2c43
Spring Boot's random value property source uses a weak PRNG unsuitable for secrets
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-m4x9-hx6x-2c43- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
NVD
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40975- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-330, CWE-338
- Updated
- 2026-11-02
OSV
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40975- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
OSVGHSA-m4x9-hx6x-2c43
Spring Boot's random value property source uses a weak PRNG unsuitable for secrets
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-m4x9-hx6x-2c43- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
Show 15 moreShow less
OSVCLSA-2026-1779410902 No score
TuxCare security update for org.springframework.boot:spring-boot (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot to address 2 CVEs. Fixed in 2.7.18-tuxcare.16.
- Record
CLSA-2026-1779410902- Updated
- 2026-11-02
OSVCLSA-2026-1779670114 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1779670114- Updated
- 2026-11-02
OSVCLSA-2026-1779842930 No score
TuxCare security update for org.springframework.boot:spring-boot (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot to address 2 CVEs. Fixed in 2.7.16-tuxcare.4.
- Record
CLSA-2026-1779842930- Updated
- 2026-11-02
OSVCLSA-2026-1779929354 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.6.15-tuxcare.12.
- Record
CLSA-2026-1779929354- Updated
- 2026-11-02
OSVCLSA-2026-1780534259 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.6-tuxcare.4.
- Record
CLSA-2026-1780534259- Updated
- 2026-11-02
OSVCLSA-2026-1781484852 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.2.
- Record
CLSA-2026-1781484852- Updated
- 2026-11-02
OSVCLSA-2026-1784164094 No score
TuxCare security update for org.springframework.boot (7 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 7 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.5.
- Record
CLSA-2026-1784164094- Updated
- 2026-11-02
OSVCLSA-2026-1788194802 No score
TuxCare security update for org.springframework.data:spring-data-commons (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788194802- Updated
- 2026-11-02
OSVCLSA-2026-1788421913 No score
TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788421913- Updated
- 2026-11-02
OSVCLSA-2026-1788421934 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788421934- Updated
- 2026-11-02
OSVCLSA-2026-1788422044 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788422044- Updated
- 2026-11-02
OSVCLSA-2026-1788422148 No score
TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788422148- Updated
- 2026-11-02
OSVCLSA-2026-1788428259 No score
TuxCare security update for org.springframework.data:spring-data-redis (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-redis to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788428259- Updated
- 2026-11-02
OSVCLSA-2026-1793015923 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.5.
- Record
CLSA-2026-1793015923- Updated
- 2026-11-02
OSVCLSA-2026-1793805334 No score
TuxCare security update for org.springframework.boot (5 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 5 CVEs. Fixed in 2.7.9-tuxcare.2.
- Record
CLSA-2026-1793805334- Updated
- 2026-11-04
Affected products
- spring boot
- vmware spring boot
- red hat hawtio hawtio 4.4.0
- red hat amq broker 7
- red hat amq clients
- red hat build of apache camel 4.18.1 for spring boot 3.5.14
- red hat build of optaplanner 8
- red hat data grid 8.6.1
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat fuse 7
- red hat jboss enterprise application platform 7
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-cassandraMaven |
4.0.0 up to 4.0.6 | 4.0.6 |
org.springframework.boot:spring-boot-cassandraMaven |
3.5.0 up to 3.5.14 | 3.5.14 |
org.springframework.boot:spring-boot-cassandraMaven |
3.4.0 to 3.4.15 | None known |
org.springframework.boot:spring-boot-cassandraMaven |
3.3.0 to 3.3.18 | None known |
org.springframework.boot:spring-boot-cassandraMaven |
through 2.7.32 | None known |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.7.18 up to 2.7.18-tuxcare.16, plus listed versions 2.7.18-tuxcare.102.7.18-tuxcare.112.7.18-tuxcare.122.7.18-tuxcare.132.7.18-tuxcare.14 Show 10 moreShow less2.7.18-tuxcare.152.7.18-tuxcare.82.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.32.7.18.tuxcare.42.7.18.tuxcare.52.7.18.tuxcare.62.7.18.tuxcare.7 |
2.7.18-tuxcare.16 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.7.16 up to 2.7.16-tuxcare.4, plus listed versions 2.7.16-tuxcare.12.7.16-tuxcare.22.7.16-tuxcare.3 |
2.7.16-tuxcare.4 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.6.15 up to 2.6.15-tuxcare.12, plus listed versions 2.6.15-tuxcare.102.6.15-tuxcare.112.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.4 Show 6 moreShow less2.6.15-tuxcare.52.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15-tuxcare.92.6.15.tuxcare.1 |
2.6.15-tuxcare.12 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 2 CVEs |
2.6.15 up to 2.6.15-tuxcare.12, plus listed versions 2.6.15-tuxcare.102.6.15-tuxcare.112.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.4 Show 6 moreShow less2.6.15-tuxcare.52.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15-tuxcare.92.6.15.tuxcare.1 |
2.6.15-tuxcare.12 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
2.4.6 up to 2.4.6-tuxcare.4, plus listed versions 2.4.6-tuxcare.32.4.6.tuxcare.2 |
2.4.6-tuxcare.4 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
2.4.6 up to 2.4.6-tuxcare.4, plus listed versions 2.4.6-tuxcare.32.4.6.tuxcare.2 |
2.4.6-tuxcare.4 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 4 CVEs |
2.4.6 up to 2.4.6-tuxcare.4, plus listed versions 2.4.6-tuxcare.32.4.6.tuxcare.2 |
2.4.6-tuxcare.4 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
2.4.6 up to 2.4.6-tuxcare.4, plus listed versions 2.4.6-tuxcare.32.4.6.tuxcare.2 |
2.4.6-tuxcare.4 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 |
2.4.5-tuxcare.2 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 |
2.4.5-tuxcare.2 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
3.2.12 up to 3.2.12-tuxcare.5, plus listed versions 3.2.12-tuxcare.13.2.12-tuxcare.23.2.12-tuxcare.33.2.12-tuxcare.4 |
3.2.12-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
3.2.12 up to 3.2.12-tuxcare.5, plus listed versions 3.2.12-tuxcare.13.2.12-tuxcare.23.2.12-tuxcare.33.2.12-tuxcare.4 |
3.2.12-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-cassandraMaven |
4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 |
4.0.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40975 is a medium vulnerability (CVSS 4.8) in Spring Boot, published April 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in org.springframework.boot:spring-boot-cassandra 4.0.6.