br.com.m4rc310:br-com-m4rc310-core-graphql (>=1.0.2, <=1.0.18), br.com.m4rc310:br-com-m4rc310-core-gtim (>=1.0.4, <=1.0.18) +41 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-devtools MAVEN version =3.4.0, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =3.0.0, =2.3.0, =2.3.0, =2.2, =3.1.9, =0.5.5, =0.5.0, =0.5.3, =0.7.0 and more Source cves: CVE-2026-40972 Source advisory: OSV:GHSA-56V8-86GJ-66JP...

br.com.m4rc310:br-com-m4rc310-gql (>=1.0.42, <=1.0.45), br.com.m4rc310:br-com-m4rc310-gtim (>=1.0.42, <=1.0.45) +33 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.3.0, <=3.3.7)

org.springframework.boot:spring-boot-devtools MAVEN version =3.3.0, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =4.0.0, =4.0.0, =1.6.0, =1.0.7, =1.0.8 and more Source cves: CVE-2026-40972 Source advisory: GHSA-56V8-86GJ-66JP...

br.com.m4rc310:br-com-m4rc310-gql (>=1.0.42, <=1.0.45), br.com.m4rc310:br-com-m4rc310-gtim (>=1.0.42, <=1.0.45) +33 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.3.0, <=3.3.7)

org.springframework.boot:spring-boot-devtools MAVEN version =3.3.0, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =4.0.0, =4.0.0, =1.6.0, =1.0.7, =1.0.8 and more Source cves: CVE-2026-40972 Source advisory: OSV:GHSA-56V8-86GJ-66JP...

ai.hyacinth.framework:core-service-admin-server (0.5.24), ai.hyacinth.framework:core-service-config-server (0.5.24) +408 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot-devtools MAVEN version =2.0.0.release, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =0.0.2, =0.0.3, =1.0.0, =1.0.5 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 and more Sourc...

org.camunda.bpm.extension.example:camunda-bpm-spring-boot-starter-example-simple (1.2.1) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (0.0.15), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.15) +67 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.10, <=0.0.14), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.10, <=0.0.14) +10 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.8, <=0.0.9), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.8, <=0.0.9) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.garethahealy.poms:springboot-parent (1.0.0), com.garethahealy:springboot-parent (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.1.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.garethahealy.poms:springboot-parent 1.0.0 -...

com.avioconsulting.maven:ics-maven-plugin (1.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.2, <=0.0.5) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.avioconsulting.maven:ics-maven-plugin 1.0 -...

Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

GHSA-56V8-86GJ-66JP Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

ai.hyacinth.framework:core-service-admin-server (0.5.24), ai.hyacinth.framework:core-service-config-server (0.5.24) +408 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot-devtools MAVEN version =2.0.0.release, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =0.0.2, =0.0.3, =1.0.0, =1.0.5 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 and more Sourc...

org.springframework.boot:spring-boot-docs (1.5.22.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.22.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.22.release...

org.springframework.boot:spring-boot-docs (1.5.21.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.21.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.21.release...

org.springframework.boot:spring-boot-docs (1.5.19.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.19.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.19.release...

no.skatteetaten.aurora.springboot:aurora-spring-boot-starter (>=3.7.2, <=3.7.3), org.springframework.boot:spring-boot-docs (1.5.15.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.15.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - no.skatteetaten.aurora.springboot:aurora-spring-boot-starter...

no.skatteetaten.aurora.springboot:aurora-spring-boot-starter (3.6.0), org.apache.skywalking:apache-skywalking-apm (>=6.1.0, <=6.4.0) +3 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.11.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - no.skatteetaten.aurora.springboot:aurora-spring-boot-starter...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.12, <=2.0.5), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=1.0.12, <=2.0.5) +6 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.10.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

de.adorsys.aspsp:aspsp-profile (>=1.2, <=1.6), de.adorsys.aspsp:consent-management-system (>=1.2, <=1.6) +231 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.8.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - de.adorsys.aspsp:aspsp-profile =1.2, =1.2, =1.3, =1.3, =1.2,...