{"id":"CVE-2026-40972","aliases":["CLSA-2026-1779238043","CLSA-2026-1779324467","CLSA-2026-1779410892","CLSA-2026-1779929354","CLSA-2026-1780534259","CLSA-2026-1781484852","CLSA-2026-1783558974","CLSA-2026-1783904634","CLSA-2026-1783991067","CLSA-2026-1784164094","CLSA-2026-1787144370","CLSA-2026-1787144963","CLSA-2026-1787145317","CLSA-2026-1788196484","CLSA-2026-1788196519","CLSA-2026-1788196634","CLSA-2026-1788200476","CLSA-2026-1788203900","CLSA-2026-1793275461","CLSA-2026-1793283094","CLSA-2026-1793299405","CLSA-2026-1794195758","CLSA-2026-1794255922","CLSA-2026-1794275759","EUVD-2026-25936","GHSA-56v8-86gj-66jp","RHLW-2026-847d178ef0f52697","ROOT-APP-MAVEN-CVE-2026-40972"],"status":"published","title":"Spring Boot DevTools remote secret comparison is vulnerable to timing attacks","description":"An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00262,"percentile":0.181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2026-04-27T23:15:19Z","modified":"2026-11-10T07:15:02Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","fixed_in":["4.0.6","3.5.14"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","fixed_in":["2.7.18-tuxcare.15","2.7.16-tuxcare.2","3.3.13-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.springframework.boot:spring-boot-devtools","fixed_in":["2.7.18.rhlw-00004"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot-devtools","fixed_in":["3.5.12-aikido.2","3.3.4-aikido.3","4.0.5-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot-devtools","fixed_in":["3.3.4-root.io.2","3.5.12-root.io.2","3.3.4-root.io.3","4.0.5-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"last_affected":"3.4.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.18"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.32"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.18"},{"fixed":"2.7.18-tuxcare.15"}]}],"versions":["2.7.18","2.7.18-tuxcare.10","2.7.18-tuxcare.11","2.7.18-tuxcare.12","2.7.18-tuxcare.13","2.7.18-tuxcare.14","2.7.18-tuxcare.8","2.7.18.tuxcare","2.7.18.tuxcare.1","2.7.18.tuxcare.2","2.7.18.tuxcare.3","2.7.18.tuxcare.4","2.7.18.tuxcare.5","2.7.18.tuxcare.6","2.7.18.tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.16"},{"fixed":"2.7.16-tuxcare.2"}]}],"versions":["2.7.16","2.7.16-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.13"},{"fixed":"3.3.13-tuxcare.3"}]}],"versions":["3.3.13","3.3.13-tuxcare.1","3.3.13-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.15"},{"fixed":"2.6.15-tuxcare.12"}]}],"versions":["2.6.15","2.6.15-tuxcare.10","2.6.15-tuxcare.11","2.6.15-tuxcare.2","2.6.15-tuxcare.3","2.6.15-tuxcare.4","2.6.15-tuxcare.5","2.6.15-tuxcare.6","2.6.15-tuxcare.7","2.6.15-tuxcare.8","2.6.15-tuxcare.9","2.6.15.tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.15"},{"fixed":"2.6.15-tuxcare.12"}]}],"versions":["2.6.15","2.6.15-tuxcare.10","2.6.15-tuxcare.11","2.6.15-tuxcare.2","2.6.15-tuxcare.3","2.6.15-tuxcare.4","2.6.15-tuxcare.5","2.6.15-tuxcare.6","2.6.15-tuxcare.7","2.6.15-tuxcare.8","2.6.15-tuxcare.9","2.6.15.tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.6"},{"fixed":"2.4.6-tuxcare.4"}]}],"versions":["2.4.6","2.4.6-tuxcare.3","2.4.6.tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.6"},{"fixed":"2.4.6-tuxcare.4"}]}],"versions":["2.4.6","2.4.6-tuxcare.3","2.4.6.tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.6"},{"fixed":"2.4.6-tuxcare.4"}]}],"versions":["2.4.6","2.4.6-tuxcare.3","2.4.6.tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.6"},{"fixed":"2.4.6-tuxcare.4"}]}],"versions":["2.4.6","2.4.6-tuxcare.3","2.4.6.tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5"},{"fixed":"2.4.5-tuxcare.2"}]}],"versions":["2.4.5","2.4.5-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5"},{"fixed":"2.4.5-tuxcare.2"}]}],"versions":["2.4.5","2.4.5-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.1"}]}],"versions":["3.4.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.1"}]}],"versions":["3.4.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.1"}]}],"versions":["3.4.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.13"},{"fixed":"3.4.13-tuxcare.1"}]}],"versions":["3.4.13"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.15"},{"fixed":"2.5.15-tuxcare.1"}]}],"versions":["2.5.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.8.RELEASE"},{"fixed":"2.1.8.RELEASE-tuxcare.1"}]}],"versions":["2.1.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.6.RELEASE"},{"fixed":"2.3.6.RELEASE-tuxcare.5"}]}],"versions":["2.3.6.RELEASE","2.3.6.RELEASE-tuxcare.1","2.3.6.RELEASE-tuxcare.2","2.3.6.RELEASE-tuxcare.3","2.3.6.RELEASE-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.6.RELEASE"},{"fixed":"2.3.6.RELEASE-tuxcare.5"}]}],"versions":["2.3.6.RELEASE","2.3.6.RELEASE-tuxcare.1","2.3.6.RELEASE-tuxcare.2","2.3.6.RELEASE-tuxcare.3","2.3.6.RELEASE-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.6.RELEASE"},{"fixed":"2.3.6.RELEASE-tuxcare.5"}]}],"versions":["2.3.6.RELEASE","2.3.6.RELEASE-tuxcare.1","2.3.6.RELEASE-tuxcare.2","2.3.6.RELEASE-tuxcare.3","2.3.6.RELEASE-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.6.RELEASE"},{"fixed":"2.3.6.RELEASE-tuxcare.5"}]}],"versions":["2.3.6.RELEASE","2.3.6.RELEASE-tuxcare.1","2.3.6.RELEASE-tuxcare.2","2.3.6.RELEASE-tuxcare.3","2.3.6.RELEASE-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.7"},{"fixed":"2.7.7-tuxcare.1"}]}],"versions":["2.7.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.7"},{"fixed":"2.7.7-tuxcare.1"}]}],"versions":["2.7.7"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.8"},{"fixed":"2.7.8-tuxcare.1"}]}],"versions":["2.7.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.8"},{"fixed":"2.7.8-tuxcare.1"}]}],"versions":["2.7.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.1"}]}],"versions":["2.7.9"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.1"}]}],"versions":["2.7.9"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.1"}]}],"versions":["2.7.9"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.1"}]}],"versions":["2.7.9"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.1"}]}],"versions":["2.7.9"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.1"}]}],"versions":["2.7.9"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.1"}]}],"versions":["2.7.9"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.3.RELEASE"},{"fixed":"2.0.3.RELEASE-tuxcare.1"}]}],"versions":["2.0.3.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.3.RELEASE"},{"fixed":"2.0.3.RELEASE-tuxcare.1"}]}],"versions":["2.0.3.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.3.RELEASE"},{"fixed":"2.0.3.RELEASE-tuxcare.1"}]}],"versions":["2.0.3.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.3.RELEASE"},{"fixed":"2.0.3.RELEASE-tuxcare.1"}]}],"versions":["2.0.3.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.3.RELEASE"},{"fixed":"2.0.3.RELEASE-tuxcare.1"}]}],"versions":["2.0.3.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.3.RELEASE"},{"fixed":"2.0.3.RELEASE-tuxcare.1"}]}],"versions":["2.0.3.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.15"},{"fixed":"2.7.15-tuxcare.2"}]}],"versions":["2.7.15","2.7.15-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.15"},{"fixed":"2.7.15-tuxcare.2"}]}],"versions":["2.7.15","2.7.15-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.15"},{"fixed":"2.7.15-tuxcare.2"}]}],"versions":["2.7.15","2.7.15-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.15"},{"fixed":"2.7.15-tuxcare.2"}]}],"versions":["2.7.15","2.7.15-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.15"},{"fixed":"2.7.15-tuxcare.2"}]}],"versions":["2.7.15","2.7.15-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-starter-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.15"},{"fixed":"2.7.15-tuxcare.2"}]}],"versions":["2.7.15","2.7.15-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-actuator-autoconfigure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.boot:spring-boot-loader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.18.RELEASE"},{"fixed":"2.1.18.RELEASE-tuxcare.1"}]}],"versions":["2.1.18.RELEASE"],"bundled":7},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.6"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.14"}]}],"versions":["3.5.0","3.5.1","3.5.10","3.5.11","3.5.12","3.5.13","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"last_affected":"3.4.15"}]}],"versions":["3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.18"}]}],"versions":["3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.32"}]}],"versions":["1.3.0.RELEASE","1.3.1.RELEASE","1.3.2.RELEASE","1.3.3.RELEASE","1.3.4.RELEASE","1.3.5.RELEASE","1.3.6.RELEASE","1.3.7.RELEASE","1.3.8.RELEASE","1.4.0.RELEASE","1.4.1.RELEASE","1.4.2.RELEASE","1.4.3.RELEASE","1.4.4.RELEASE","1.4.5.RELEASE","1.4.6.RELEASE","1.4.7.RELEASE","1.5.0.RELEASE","1.5.1.RELEASE","1.5.10.RELEASE","1.5.11.RELEASE","1.5.12.RELEASE","1.5.13.RELEASE","1.5.14.RELEASE","1.5.15.RELEASE","1.5.16.RELEASE","1.5.17.RELEASE","1.5.18.RELEASE","1.5.19.RELEASE","1.5.2.RELEASE","1.5.20.RELEASE","1.5.21.RELEASE","1.5.22.RELEASE","1.5.3.RELEASE","1.5.4.RELEASE","1.5.5.RELEASE","1.5.6.RELEASE","1.5.7.RELEASE","1.5.8.RELEASE","1.5.9.RELEASE","2.0.0.RELEASE","2.0.1.RELEASE","2.0.2.RELEASE","2.0.3.RELEASE","2.0.4.RELEASE","2.0.5.RELEASE","2.0.6.RELEASE","2.0.7.RELEASE","2.0.8.RELEASE","2.0.9.RELEASE","2.1.0.RELEASE","2.1.1.RELEASE","2.1.10.RELEASE","2.1.11.RELEASE","2.1.12.RELEASE","2.1.13.RELEASE","2.1.14.RELEASE","2.1.15.RELEASE","2.1.16.RELEASE","2.1.17.RELEASE","2.1.18.RELEASE","2.1.2.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","2.1.7.RELEASE","2.1.8.RELEASE","2.1.9.RELEASE","2.2.0.RELEASE","2.2.1.RELEASE","2.2.10.RELEASE","2.2.11.RELEASE","2.2.12.RELEASE","2.2.13.RELEASE","2.2.2.RELEASE","2.2.3.RELEASE","2.2.4.RELEASE","2.2.5.RELEASE","2.2.6.RELEASE","2.2.7.RELEASE","2.2.8.RELEASE","2.2.9.RELEASE","2.3.0.RELEASE","2.3.1.RELEASE","2.3.10.RELEASE","2.3.11.RELEASE","2.3.12.RELEASE","2.3.2.RELEASE","2.3.3.RELEASE","2.3.4.RELEASE","2.3.5.RELEASE","2.3.6.RELEASE","2.3.7.RELEASE","2.3.8.RELEASE","2.3.9.RELEASE","2.4.0","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.14","2.5.15","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18.rhlw-00004"}]}],"versions":["1.3.0.RELEASE","1.3.1.RELEASE","1.3.2.RELEASE","1.3.3.RELEASE","1.3.4.RELEASE","1.3.5.RELEASE","1.3.6.RELEASE","1.3.7.RELEASE","1.3.8.RELEASE","1.4.0.RELEASE","1.4.1.RELEASE","1.4.2.RELEASE","1.4.3.RELEASE","1.4.4.RELEASE","1.4.5.RELEASE","1.4.6.RELEASE","1.4.7.RELEASE","1.5.0.RELEASE","1.5.1.RELEASE","1.5.10.RELEASE","1.5.11.RELEASE","1.5.12.RELEASE","1.5.13.RELEASE","1.5.14.RELEASE","1.5.15.RELEASE","1.5.16.RELEASE","1.5.17.RELEASE","1.5.18.RELEASE","1.5.19.RELEASE","1.5.2.RELEASE","1.5.20.RELEASE","1.5.21.RELEASE","1.5.22.RELEASE","1.5.3.RELEASE","1.5.4.RELEASE","1.5.5.RELEASE","1.5.6.RELEASE","1.5.7.RELEASE","1.5.8.RELEASE","1.5.9.RELEASE","2.0.0.RELEASE","2.0.1.RELEASE","2.0.2.RELEASE","2.0.3.RELEASE","2.0.4.RELEASE","2.0.5.RELEASE","2.0.6.RELEASE","2.0.7.RELEASE","2.0.8.RELEASE","2.0.9.RELEASE","2.1.0.RELEASE","2.1.1.RELEASE","2.1.10.RELEASE","2.1.11.RELEASE","2.1.12.RELEASE","2.1.13.RELEASE","2.1.14.RELEASE","2.1.15.RELEASE","2.1.16.RELEASE","2.1.17.RELEASE","2.1.18.RELEASE","2.1.2.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","2.1.7.RELEASE","2.1.8.RELEASE","2.1.9.RELEASE","2.2.0.RELEASE","2.2.1.RELEASE","2.2.10.RELEASE","2.2.11.RELEASE","2.2.12.RELEASE","2.2.13.RELEASE","2.2.2.RELEASE","2.2.3.RELEASE","2.2.4.RELEASE","2.2.5.RELEASE","2.2.6.RELEASE","2.2.7.RELEASE","2.2.8.RELEASE","2.2.9.RELEASE","2.3.0.RELEASE","2.3.1.RELEASE","2.3.10.RELEASE","2.3.11.RELEASE","2.3.12.RELEASE","2.3.2.RELEASE","2.3.3.RELEASE","2.3.4.RELEASE","2.3.5.RELEASE","2.3.6.RELEASE","2.3.7.RELEASE","2.3.8.RELEASE","2.3.9.RELEASE","2.4.0","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.14","2.5.15","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-aikido.2"},{"fixed":"3.3.4-aikido.3"},{"fixed":"4.0.5-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.boot:spring-boot-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-root.io.2"},{"fixed":"3.5.12-root.io.2"},{"fixed":"3.3.4-root.io.3"},{"fixed":"4.0.5-root.io.3"}]}]}],"products":[{"vendor":"spring","product":"spring boot"},{"vendor":"vmware","product":"spring_boot"}],"references":[{"url":"https://spring.io/security/cve-2026-40972","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40972","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-56v8-86gj-66jp","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40972.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-boot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40972","description":"An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.","status":"published","published":"2026-04-27T23:15:19.194Z","modified":"2026-04-29T03:55:44.263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-25936","description":"An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.","status":"published","published":"2026-04-27T23:15:19Z","modified":"2026-04-29T03:55:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:23.176094Z"}],"ghsa":[{"id":"GHSA-56v8-86gj-66jp","title":"Spring Boot DevTools remote secret comparison is vulnerable to timing attacks","description":"An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.","status":"published","published":"2026-04-28T00:31:40Z","modified":"2026-05-06T19:02:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:40:01.917039Z"}],"nvd":[{"id":"CVE-2026-40972","description":"An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.","status":"published","published":"2026-04-28T00:16:24.21Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"CVE-2026-40972","description":"An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.","status":"published","published":"2026-04-27T23:15:19.194Z","modified":"2026-10-28T02:30:45.995583799Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-56v8-86gj-66jp","title":"Spring Boot DevTools remote secret comparison is vulnerable to timing attacks","description":"An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.","status":"published","published":"2026-04-28T00:31:40Z","modified":"2026-05-06T19:26:28.614099Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"RHLW-2026-847d178ef0f52697","title":"Lightwell Security Advisory: spring-boot-devtools 2.7.18.rhlw-00004","description":"Red Hat Lightwell has released org.springframework.boot:spring-boot-devtools 2.7.18.rhlw-00004 with a backported security fix.\n\nCVE-2026-40972: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.\n\nThis patched artifact is a drop-in replacement for org.springframework.boot:spring-boot-devtools 2.7.18 from Maven Central.","status":"published","published":"2026-10-12T16:59:35Z","modified":"2026-10-27T04:00:11.946934615Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"CLSA-2026-1779238043","title":"TuxCare security update for org.springframework.boot:spring-boot-devtools (1 CVE)","description":"TuxCare rebuilt org.springframework.boot:spring-boot-devtools to address 1 CVE. Fixed in 2.7.18-tuxcare.15.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-29T19:45:08.371116538Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779324467","title":"TuxCare security update for org.springframework.boot:spring-boot-devtools (1 CVE)","description":"TuxCare rebuilt org.springframework.boot:spring-boot-devtools to address 1 CVE. Fixed in 2.7.16-tuxcare.2.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-29T19:45:09.569748078Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779410892","title":"TuxCare security update for org.springframework.boot:spring-boot-devtools (1 CVE)","description":"TuxCare rebuilt org.springframework.boot:spring-boot-devtools to address 1 CVE. Fixed in 3.3.13-tuxcare.3.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-30T07:30:10.346034144Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779929354","title":"TuxCare security update for org.springframework.boot (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.6.15-tuxcare.12.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-11-02T19:45:33.131664183Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1780534259","title":"TuxCare security update for org.springframework.boot (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.6-tuxcare.4.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-11-02T19:45:36.98050967Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1781484852","title":"TuxCare security update for org.springframework.boot (4 CVEs)","description":"TuxCare rebuilt 2 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.2.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-11-02T19:45:36.894071379Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1783558974","title":"TuxCare security update for org.springframework.boot (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-11-02T19:45:41.834532071Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1783904634","title":"TuxCare security update for org.springframework.boot (6 CVEs)","description":"TuxCare rebuilt 6 org.springframework.boot packages to address 6 CVEs. Fixed in 2.5.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-11-02T19:45:40.131558266Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1783991067","title":"TuxCare security update for org.springframework.boot (9 CVEs)","description":"TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-11-02T19:45:38.77651252Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1784164094","title":"TuxCare security update for org.springframework.boot (7 CVEs)","description":"TuxCare rebuilt 4 org.springframework.boot packages to address 7 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.5.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-11-02T19:45:45.716571355Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1787144370","title":"TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.","status":"withdrawn","published":"2026-08-19T12:59:30Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787144963","title":"TuxCare security update for org.springframework.data (4 CVEs)","description":"TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.","status":"withdrawn","published":"2026-08-19T13:09:23Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787145317","title":"TuxCare security update for org.springframework.data (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.","status":"withdrawn","published":"2026-08-19T13:15:17Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1788196484","title":"TuxCare security update for org.springframework.data (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.","status":"withdrawn","published":"2026-08-31T17:14:44Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788196519","title":"TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.","status":"withdrawn","published":"2026-08-31T17:15:19Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788196634","title":"TuxCare security update for org.springframework.data (4 CVEs)","description":"TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.","status":"withdrawn","published":"2026-08-31T17:17:14Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788200476","title":"TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.","status":"withdrawn","published":"2026-08-31T18:21:16Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788203900","title":"TuxCare security update for org.springframework.data:spring-data-redis (4 CVEs)","description":"TuxCare rebuilt org.springframework.data:spring-data-redis to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.","status":"withdrawn","published":"2026-08-31T19:18:20Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1793275461","title":"TuxCare security update for org.springframework.boot (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.7.7-tuxcare.1.","status":"published","published":"2026-10-29T12:04:21Z","modified":"2026-11-02T19:46:32.650813033Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793283094","title":"TuxCare security update for org.springframework.boot (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.7.8-tuxcare.1.","status":"published","published":"2026-10-29T15:11:35Z","modified":"2026-11-02T19:46:32.747760291Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793299405","title":"TuxCare security update for org.springframework.boot (8 CVEs)","description":"TuxCare rebuilt 7 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.9-tuxcare.1.","status":"published","published":"2026-10-29T19:43:26Z","modified":"2026-11-02T19:46:33.0199076Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1794195758","title":"TuxCare security update for org.springframework.boot (10 CVEs)","description":"TuxCare rebuilt 6 org.springframework.boot packages to address 10 CVEs. Fixed in 2.0.3.RELEASE-tuxcare.1.","status":"published","published":"2026-11-09T04:42:39Z","modified":"2026-11-09T07:15:04.226723341Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794255922","title":"TuxCare security update for org.springframework.boot (8 CVEs)","description":"TuxCare rebuilt 6 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.15-tuxcare.2.","status":"published","published":"2026-11-09T21:25:23Z","modified":"2026-11-10T01:15:05.398885429Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794275759","title":"TuxCare security update for org.springframework.boot (7 CVEs)","description":"TuxCare rebuilt 5 org.springframework.boot packages to address 7 CVEs. Fixed in 2.1.18.RELEASE-tuxcare.1.","status":"published","published":"2026-11-10T02:56:00Z","modified":"2026-11-10T07:15:02.338357049Z","updated_at":"2026-11-10T07:24:16.839298Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-40972","title":"CVE-2026-40972 in org.springframework.boot:spring-boot-devtools - Patched by Root","description":"Root has patched CVE-2026-40972 in the org.springframework.boot:spring-boot-devtools package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-23T12:01:31Z","modified":"2026-09-23T13:15:03.343125301Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}