Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure (1.0.2), cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2) +266 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.21.release)

org.springframework.boot:spring-boot MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure 1.0.2 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10548 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

GHSA-MQVW-JFMH-93QQ Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16, 3.3.0–3.3.18 fix 3.3.19, 2.7.0–2.7.32 fix 2.7.33; Cassandra SSL...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

GHSA-5368-6H4H-GR29 Spring Boot's PID file write follows symlinks at predictable default path

When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16,...

com.github.cafdataprocessing:boilerplate-api-web (>=2.0.0-5, <=2.3.0-92), com.github.cafdataprocessing:corepolicy-web (>=1.0.0-4, <=1.2.0-165) +36 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.3.release)

org.springframework.boot:spring-boot MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.cafdataprocessing:boilerplate-api-web =2.0.0-5, =1.0.0-4, =1.1.0.cr3...

au.com.mountain-pass:hyperstate (>=1, <=3), cc.catalysts.boot:cat-boot-cluster (>=0.0.10, <=0.1.14) +196 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.3.2.release)

org.springframework.boot:spring-boot MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.0.10, =0.0.5, =0.0.5, =0.1.8, =0.0.10,...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +25 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.0.1.release)

org.springframework.boot:spring-boot MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.ebay:lightning-client 0.9.0 - com.ebay:lightning-core 0.9.0 -...

com.erudika:para (1.8.0), com.github.totyumengr:minicubes-cluster (0.2) +55 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.4.release)

org.springframework.boot:spring-boot MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.erudika:para 1.8.0 - com.github.totyumengr:minicubes-cluster 0.2 -...

com.bytebybyte:google-geocoding (>=3.0.0, <=3.0.1), com.bytebybyte:mapquest-open-geocoding (1.0.0) +60 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.6.release)

org.springframework.boot:spring-boot MAVEN version 1.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.bytebybyte:google-geocoding =3.0.0, =0.7, =0.8.0 -...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-application (>=1.0.0, <=1.2.0) +37016 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.0, =4.6.0.0 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

GHSA-M4X9-HX6X-2C43 Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15...

club.zhcs:axe-apm (>=1.5.13, <=1.5.13.2), club.zhcs:axe-sigar (>=1.5.13, <=1.5.13.2) +613 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.13.release)

org.springframework.boot:spring-boot MAVEN version 1.5.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - club.zhcs:axe-apm =1.5.13, =1.5.13, =1.5.13, =1.5.13, =0.0.7.release, =1.0.1,...

com.fastjrun.codeg.apibase:sdkg-apibase-provider (>=3.1, <=3.2.4), com.fastjrun.codeg.example:sdkg-example-provider (>=2.1, <=3.0) +182 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.11.release)

org.springframework.boot:spring-boot MAVEN version 1.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.fastjrun.codeg.apibase:sdkg-apibase-provider =3.1, =2.1, =2.0,...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +691 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.4.release)

org.springframework.boot:spring-boot MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0, =1.0, =1.0, =1.0.1, =1.0.0, =a.1.0.0,...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter...

Spring Boot's PID file write follows symlinks at predictable default path

When an application is configured to use ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16,...

com.github.wanggit:access-frequency-spring-boot-starter (>=1.0.0, <=1.0.1-snapshots), com.github.xiaoping1988.spring.boot:mybatis-ping-spring-boot (1.0.1) +229 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.github.wanggit:access-frequency-spring-boot-starter =1.0....