CVE-2026-40977
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In Spring Boot, when an application uses ApplicationPidFileWriter, a local attacker with write access to the PID file location can corrupt one file on the host each time the application starts. Affects versions 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, 2.7.0-2.7.32.
Risk Assessment
An attacker can deliberately corrupt a file on the host, potentially leading to data loss or system disruption.
Recommendation
Update Spring Boot to version 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33 depending on the branch used.
Original NVD description (English source)
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.