CVE-2026-40972

State: Published
Severity: 7.5 High
Published: Apr 27, 2026
Updated: Apr 29, 2026
Reserved: Apr 16, 2026

Description

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	vmware

Weaknesses

CWE-208 Observable Timing Discrepancy

Affected Products

Product	Versions
Spring BootSpring	4.0.0 to before 4.0.6Affected 3.5.0 to before 3.5.14Affected 3.4.0 to before 3.4.16Affected 3.3.0 to before 3.3.19Affected 2.7.0 to before 2.7.33Affected

References

https://spring.io/security/cve-2026-40972

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.