CVE-2026-40977
Spring Boot's PID file write follows symlinks at predictable default path
When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (ApplicationPidFileWriter). Versions that are no longer supported are also affected per vendor advisory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (ApplicationPidFileWriter). Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40977- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2026-25941
When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (ApplicationPidFileWriter). Versions that are no longer supported are also affected per vendor advisory.
- Record
EUVD-2026-25941- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5368-6h4h-gr29
Spring Boot's PID file write follows symlinks at predictable default path
When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (ApplicationPidFileWriter). Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-5368-6h4h-gr29- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
NVD
When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (ApplicationPidFileWriter). Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40977- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV
When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (ApplicationPidFileWriter). Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40977- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVGHSA-5368-6h4h-gr29
Spring Boot's PID file write follows symlinks at predictable default path
When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (ApplicationPidFileWriter). Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-5368-6h4h-gr29- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
Show 16 moreShow less
OSVCLSA-2026-1779410902 No score
TuxCare security update for org.springframework.boot:spring-boot (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot to address 2 CVEs. Fixed in 2.7.18-tuxcare.16.
- Record
CLSA-2026-1779410902- Updated
- 2026-11-02
OSVCLSA-2026-1779670114 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1779670114- Updated
- 2026-11-02
OSVCLSA-2026-1779842930 No score
TuxCare security update for org.springframework.boot:spring-boot (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot to address 2 CVEs. Fixed in 2.7.16-tuxcare.4.
- Record
CLSA-2026-1779842930- Updated
- 2026-11-02
OSVCLSA-2026-1779842931 No score
TuxCare security update for org.springframework.boot:spring-boot (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot to address 2 CVEs. Fixed in 2.6.15-tuxcare.11.
- Record
CLSA-2026-1779842931- Updated
- 2026-11-02
OSVCLSA-2026-1780534259 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.6-tuxcare.4.
- Record
CLSA-2026-1780534259- Updated
- 2026-11-02
OSVCLSA-2026-1781484852 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.2.
- Record
CLSA-2026-1781484852- Updated
- 2026-11-02
OSVCLSA-2026-1784164094 No score
TuxCare security update for org.springframework.boot (7 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 7 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.5.
- Record
CLSA-2026-1784164094- Updated
- 2026-11-02
OSVCLSA-2026-1788194802 No score
TuxCare security update for org.springframework.data:spring-data-commons (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788194802- Updated
- 2026-11-02
OSVCLSA-2026-1788421913 No score
TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788421913- Updated
- 2026-11-02
OSVCLSA-2026-1788421934 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788421934- Updated
- 2026-11-02
OSVCLSA-2026-1788422044 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788422044- Updated
- 2026-11-02
OSVCLSA-2026-1788422148 No score
TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788422148- Updated
- 2026-11-02
OSVCLSA-2026-1788428259 No score
TuxCare security update for org.springframework.data:spring-data-redis (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-redis to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788428259- Updated
- 2026-11-02
OSVCLSA-2026-1789414950 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3.
- Record
CLSA-2026-1789414950- Updated
- 2026-11-02
OSVCLSA-2026-1793782615 No score
TuxCare security update for org.springframework.boot:spring-boot (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot to address 1 CVE. Fixed in 3.2.12-tuxcare.6.
- Record
CLSA-2026-1793782615- Updated
- 2026-11-04
OSVCLSA-2026-1793805334 No score
TuxCare security update for org.springframework.boot (5 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 5 CVEs. Fixed in 2.7.9-tuxcare.2.
- Record
CLSA-2026-1793805334- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-cassandraMaven |
4.0.0 up to 4.0.6 | 4.0.6 |
org.springframework.boot:spring-boot-cassandraMaven |
3.5.0 up to 3.5.14 | 3.5.14 |
org.springframework.boot:spring-boot-cassandraMaven |
3.4.0 to 3.4.15 | None known |
org.springframework.boot:spring-boot-cassandraMaven |
3.3.0 to 3.3.18 | None known |
org.springframework.boot:spring-boot-cassandraMaven |
through 2.7.32 | None known |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.7.18 up to 2.7.18-tuxcare.16, plus listed versions 2.7.18-tuxcare.102.7.18-tuxcare.112.7.18-tuxcare.122.7.18-tuxcare.132.7.18-tuxcare.14 Show 10 moreShow less2.7.18-tuxcare.152.7.18-tuxcare.82.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.32.7.18.tuxcare.42.7.18.tuxcare.52.7.18.tuxcare.62.7.18.tuxcare.7 |
2.7.18-tuxcare.16 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.7.16 up to 2.7.16-tuxcare.4, plus listed versions 2.7.16-tuxcare.12.7.16-tuxcare.22.7.16-tuxcare.3 |
2.7.16-tuxcare.4 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.6.15 up to 2.6.15-tuxcare.11, plus listed versions 2.6.15-tuxcare.102.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.42.6.15-tuxcare.5 Show 5 moreShow less2.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15-tuxcare.92.6.15.tuxcare.1 |
2.6.15-tuxcare.11 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
2.4.6 up to 2.4.6-tuxcare.4, plus listed versions 2.4.6-tuxcare.32.4.6.tuxcare.2 |
2.4.6-tuxcare.4 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
2.4.6 up to 2.4.6-tuxcare.4, plus listed versions 2.4.6-tuxcare.32.4.6.tuxcare.2 |
2.4.6-tuxcare.4 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 4 CVEs |
2.4.6 up to 2.4.6-tuxcare.4, plus listed versions 2.4.6-tuxcare.32.4.6.tuxcare.2 |
2.4.6-tuxcare.4 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
2.4.6 up to 2.4.6-tuxcare.4, plus listed versions 2.4.6-tuxcare.32.4.6.tuxcare.2 |
2.4.6-tuxcare.4 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 |
2.4.5-tuxcare.2 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 |
2.4.5-tuxcare.2 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-bootTuxCare:Maven |
3.2.12 up to 3.2.12-tuxcare.6, plus listed versions 3.2.12-tuxcare.13.2.12-tuxcare.23.2.12-tuxcare.33.2.12-tuxcare.43.2.12-tuxcare.5 |
3.2.12-tuxcare.6 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 5 CVEs |
2.7.9 up to 2.7.9-tuxcare.2, plus listed versions 2.7.9-tuxcare.1 |
2.7.9-tuxcare.2 |
org.springframework.boot:spring-boot-cassandraMaven |
4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 |
4.0.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| affected | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40977 is a medium vulnerability (CVSS 4.7) in Spring Boot, published April 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in org.springframework.boot:spring-boot-cassandra 4.0.6.