CVE-2026-40992
Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
- Record
CVE-2026-40992- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2026-36203
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
- Record
EUVD-2026-36203- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9wxp-w4px-32vh
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
- Record
GHSA-9wxp-w4px-32vh- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
- Record
CVE-2026-40992- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
- Record
CVE-2026-40992- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVGHSA-9wxp-w4px-32vh
Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
- Record
GHSA-9wxp-w4px-32vh- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1789414950 No score
TuxCare security update for org.springframework.boot (3 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 3 CVEs. Fixed in 3.4.13-tuxcare.3.
- Record
CLSA-2026-1789414950- Updated
- 2026-11-02
OSVCLSA-2026-1793299405 No score
TuxCare security update for org.springframework.boot (8 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.9-tuxcare.1.
- Record
CLSA-2026-1793299405- Updated
- 2026-11-02
OSVCLSA-2026-1793801974 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 2 CVEs. Fixed in 2.7.8-tuxcare.2.
- Record
CLSA-2026-1793801974- Updated
- 2026-11-04
OSVROOT-APP-MAVEN-CVE-2026-40992 No score
CVE-2026-40992 in io.root.org.springframework.boot:spring-boot-autoconfigure - Patched by Root
Root has patched CVE-2026-40992 in the io.root.org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40992- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-starter-mailMaven |
4.0.0 to 4.0.6 | 4.0.7 |
org.springframework.boot:spring-boot-starter-mailMaven |
3.5.0 to 3.5.14 | 3.5.15 |
org.springframework.boot:spring-boot-starter-mailMaven |
3.4.0 to 3.4.16 | None known |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 3 CVEs |
3.4.13 up to 3.4.13-tuxcare.3, plus listed versions 3.4.13-tuxcare.13.4.13-tuxcare.2 |
3.4.13-tuxcare.3 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 |
2.7.8-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 |
2.7.8-tuxcare.2 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 2 CVEs |
2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 |
2.7.8-tuxcare.2 |
org.springframework.boot:spring-boot-starter-mailMaven |
4.0.0 up to 4.0.7, plus listed versions 4.0.14.0.24.0.34.0.44.0.54.0.6 |
4.0.7 |
org.springframework.boot:spring-boot-starter-mailMaven |
3.5.0 up to 3.5.15, plus listed versions 3.5.13.5.103.5.113.5.123.5.13 Show 9 moreShow less3.5.143.5.23.5.33.5.43.5.53.5.63.5.73.5.83.5.9 |
3.5.15 |
org.springframework.boot:spring-boot-starter-mailMaven |
3.4.0 to 3.4.16, plus listed versions 3.4.13.4.103.4.113.4.123.4.13 Show 8 moreShow less3.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9 |
None known |
io.root.org.springframework.boot:spring-boot-autoconfigureRoot:Maven |
before 3.5.3-root.io.3 | 3.5.3-root.io.34.0.6-root.io.1 |
org.springframework.boot:spring-boot-autoconfigureRoot:Maven |
before 3.5.3-aikido.3 | 3.5.3-aikido.34.0.6-aikido.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40992 is a medium vulnerability (CVSS 5.0) in Spring Boot, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in org.springframework.boot:spring-boot-starter-mail 4.0.7.