Spring Boot vulnerabilities

• spring boot, vmware spring boot +1 more Predictable Temp Directory in Artemis Auto-configuration CVE-2026-41001 Fix available 5.3 MediumJune 11, 2026
• spring boot, vmware spring boot +1 more Mail Auto-Configuration Does Not Enable SSL Hostname Verification CVE-2026-40992 Fix available 5.0 MediumJune 11, 2026
• spring boot, vmware spring boot +1 more Spring Boot's PID file write follows symlinks at predictable default path CVE-2026-40977 Fix available 4.7 MediumApril 27, 2026
• spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 more Spring Boot's default security filter chain has no authorization rule with Actuator but without Health CVE-2026-40976 Fix available 9.1 CriticalApril 27, 2026
• spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 more Spring Boot's random value property source uses a weak PRNG unsuitable for secrets CVE-2026-40975 Fix available 4.8 MediumApril 27, 2026
• spring boot, vmware spring boot +1 more Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification CVE-2026-40974 Fix available 5.0 MediumApril 27, 2026
• spring boot, vmware spring boot +1 more Spring Boot accepts predictable temp directory without ownership verification CVE-2026-40973 Fix available 7.0 HighApril 27, 2026
• spring boot, vmware spring boot +1 more Spring Boot DevTools remote secret comparison is vulnerable to timing attacks CVE-2026-40972 Fix available 7.5 HighApril 27, 2026
• spring boot, vmware spring boot +1 more Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker CVE-2026-40971 Fix available 5.0 MediumApril 27, 2026
• spring boot, vmware spring boot +1 more Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server. CVE-2026-40970 Fix available 5.0 MediumApril 27, 2026
• spring boot, vmware spring boot +1 more Authentication Bypass under Actuator Health groups paths CVE-2026-22731 Fix available 8.2 HighMarch 19, 2026
• spring boot Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed CVE-2025-22235 Public exploitFix available 7.3 HighApril 28, 2025
• spring boot CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader CVE-2024-38807 Fix available 6.3 MediumAugust 23, 2024
• spring boot, vmware spring boot +1 more Spring Boot server Web Observations DoS Vulnerability CVE-2023-34055 Fix available 5.3 MediumNovember 28, 2023
• spring boot, vmware spring boot +1 more Spring Boot Welcome Page Denial of Service CVE-2023-20883 Fix available 7.5 HighMay 26, 2023
• spring boot, vmware spring boot +1 more Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry CVE-2023-20873 Fix available 9.8 CriticalApril 20, 2023
• pivotal software spring data java persistence api, spring boot +1 more Additional information exposure with Spring Data JPA derived queries CVE-2019-3797 Fix available 3.5 LowMay 6, 2019
• dell emc spring boot, spring boot +1 more Moderate severity vulnerability that affects org.springframework.boot:spring-boot CVE-2018-1196 Fix available 5.9 MediumMarch 19, 2018