Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-e2c3-rmu2-9ydj
Vulnerability ID VCID-e2c3-rmu2-9ydj
Aliases CVE-2026-40972
GHSA-56v8-86gj-66jp
Summary An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-208 Observable Timing Discrepancy
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40972.json
epss 0.00058 https://api.first.org/data/v1/epss?cve=CVE-2026-40972
epss 0.00058 https://api.first.org/data/v1/epss?cve=CVE-2026-40972
epss 0.00058 https://api.first.org/data/v1/epss?cve=CVE-2026-40972
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-56v8-86gj-66jp
cvssv3.1 7.5 https://github.com/spring-projects/spring-boot
generic_textual HIGH https://github.com/spring-projects/spring-boot
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-40972
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-40972
cvssv3.1 7.5 https://spring.io/security/cve-2026-40972
generic_textual HIGH https://spring.io/security/cve-2026-40972
ssvc Track https://spring.io/security/cve-2026-40972
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40972.json
https://api.first.org/data/v1/epss?cve=CVE-2026-40972
https://github.com/spring-projects/spring-boot
https://nvd.nist.gov/vuln/detail/CVE-2026-40972
2463332 https://bugzilla.redhat.com/show_bug.cgi?id=2463332
cve-2026-40972 https://spring.io/security/cve-2026-40972
GHSA-56v8-86gj-66jp https://github.com/advisories/GHSA-56v8-86gj-66jp
RHSA-2026:17668 https://access.redhat.com/errata/RHSA-2026:17668
RHSA-2026:21772 https://access.redhat.com/errata/RHSA-2026:21772
RHSA-2026:25089 https://access.redhat.com/errata/RHSA-2026:25089
No exploits are available.
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40972.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/spring-projects/spring-boot
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2026-40972
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://spring.io/security/cve-2026-40972
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-04-28T12:45:17Z/ Found at https://spring.io/security/cve-2026-40972
Exploit Prediction Scoring System (EPSS)
Percentile 0.18558
EPSS Score 0.00058
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:53:09.287791+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/40xxx/CVE-2026-40972.json 38.6.0