com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.10, <=0.0.14), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.10, <=0.0.14) +10 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (0.0.15), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.15) +67 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

org.camunda.bpm.extension.example:camunda-bpm-spring-boot-starter-example-simple (1.2.1) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

io.fabric8:fabric8-maven-generator-spring-boot (>=3.1.66, <=3.1.70), io.fabric8:fabric8-maven-plugin (>=3.1.65, <=3.1.70) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - io.fabric8:fabric8-maven-generator-spring-boot =3.1.66,...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (0.0.16), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.16) +103 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +4 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.4.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.okta.spring.examples:okta-spring-boot-siw-jquery-example (0.1.0), org.apereo.cas:cas-management-webapp (5.2.0-rc1) +178 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.4.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.okta.spring.examples:okta-spring-boot-siw-jquery-example...

org.springframework.boot:spring-boot-docs (1.5.21.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.21.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.21.release...

br.com.m4rc310:br-com-m4rc310-core-graphql (>=1.0.2, <=1.0.18), br.com.m4rc310:br-com-m4rc310-core-gtim (>=1.0.4, <=1.0.18) +41 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-devtools MAVEN version =3.4.0, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =3.0.0, =2.3.0, =2.3.0, =2.2, =3.1.9, =0.5.5, =0.5.0, =0.5.3, =0.7.0 and more Source cves: CVE-2026-40972 Source advisory: GHSA-56V8-86GJ-66JP...

com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...

com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...

com.jayxu:demo (>=0.10.0, <=0.11.0), com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example (>=3.0.9, <=3.1.0) +9 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=4.0.1, <=4.0.3)

org.springframework.boot:spring-boot-devtools MAVEN version =4.0.1, =0.10.0, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =4.0.0, =2.0.0, =2.1.1 - de.tschuehly:spring-view-component-thymeleaf 0.9.1 - io.stereov.singularity:core 1.10.6 - org.flowable:flowable-app-rest 8.0.0 - se.swedenconnect.bankid:bankid-idp...

com.jayxu:demo (>=0.10.0, <=0.11.0), com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example (>=3.0.9, <=3.1.0) +9 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=4.0.1, <=4.0.3)

org.springframework.boot:spring-boot-devtools MAVEN version =4.0.1, =0.10.0, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =4.0.0, =2.0.0, =2.1.1 - de.tschuehly:spring-view-component-thymeleaf 0.9.1 - io.stereov.singularity:core 1.10.6 - org.flowable:flowable-app-rest 8.0.0 - se.swedenconnect.bankid:bankid-idp...

am.ik.home:uaa-server (1.9.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.6, <=2.0.1) +51 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - am.ik.home:uaa-server 1.9.0 -...

Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...

Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

com.swisscom.cloud.sb:broker (>=2.11.2, <=2.12.1), edu.wisc.my.apps:lti-proxy (>=1.0.1, <=2.0.1) +116 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.swisscom.cloud.sb:broker =2.11.2, =1.0.1, =1.0.3, =0.0.1,...

GHSA-56V8-86GJ-66JP Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

org.springframework.boot:spring-boot-docs (1.5.5.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.5.release Sourc...

org.springframework.boot:spring-boot-docs (1.5.22.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.22.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.22.release...