CVE-2026-40973
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Spring Boot versions 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, 2.7.0-2.7.32 have a vulnerability due to a predictable temp directory (ApplicationTemp). A local attacker can take control of this directory, and with persistent sessions enabled, can read sessions, hijack users, or execute code.
Risk Assessment
An attacker on the same host can hijack authenticated user sessions or execute arbitrary code in the application context, compromising confidentiality and integrity.
Recommendation
Update Spring Boot to version 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33 depending on your branch.
Other vulnerabilities in Spring Boot
See all- CVE-2026-40976Critical
Spring Boot versions 4.0.0–4.0.5 have ineffective default web security, allowing unauthorized access to all endpoints. The vulnerability affects servlet-based applications without custom Spring Security configuration, using spring-boot-actuator-autoconfigure and not depending on spring-boot-health.
- CVE-2026-41001Medium
Vulnerability in Spring Boot where ArtemisEmbeddedConfigurationFactory uses a fixed, predictable path for the Artemis broker data directory. A local attacker can create a symlink before application start.
- CVE-2026-40992Medium
In Spring Boot, a vulnerability was found in the mail auto-configuration that does not enable hostname verification. Applications that explicitly set the JavaMail property (e.g., spring.mail.properties.mail.smtp.ssl.checkserveridentity=true) are not affected. Affected versions are Spring Boot 4.0.0-4.0.6, 3.5.0-3.5.14, and 3.4.0-3.4.16.
- CVE-2026-40977Medium
In Spring Boot, when an application uses ApplicationPidFileWriter, a local attacker with write access to the PID file location can corrupt one file on the host each time the application starts. Affects versions 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, 2.7.0-2.7.32.
- CVE-2026-40975Medium
In Spring Boot, values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected, but ${random.int} and ${random.long} have a predictable range. Affected versions: 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32.
- CVE-2026-40974Medium
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. This affects multiple Spring Boot versions including 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32.
- CVE-2026-40972High
An attacker on the same network as the remote application may use a timing attack to leak information about the remote secret. In extreme cases, this could allow the attacker to determine the secret and upload modified classes, achieving remote code execution.
- CVE-2026-40971Medium
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected versions: Spring Boot 4.0.0–4.0.5 (fixed in 4.0.6), 3.5.0–3.5.13 (fixed in 3.5.14).
Original NVD description (English source)
A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.