ROOT-APP-MAVEN-CVE-2026-40972 CVE-2026-40972 in org.springframework.boot:spring-boot-devtools - Patched by Root

Root has patched CVE-2026-40972 in the org.springframework.boot:spring-boot-devtools package for Root:Maven. Multiple fixed versions available...

org.springframework.boot:spring-boot-docs (1.5.0.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.0.release Sourc...

com.alibaba:tac-console (0.0.4), com.alibaba:tac-container (0.0.4) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.alibaba:tac-console 0.0.4 - com.alibaba:tac-container 0.0...

com.swisscom.cloud.sb:broker (>=2.11.2, <=2.12.1), edu.wisc.my.apps:lti-proxy (>=1.0.1, <=2.0.1) +116 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.swisscom.cloud.sb:broker =2.11.2, =1.0.1, =1.0.3, =0.0.1,...

io.fabric8:fabric8-maven-generator-spring-boot (>=3.1.66, <=3.1.70), io.fabric8:fabric8-maven-plugin (>=3.1.65, <=3.1.70) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - io.fabric8:fabric8-maven-generator-spring-boot =3.1.66,...

de.adorsys.aspsp:aspsp-profile (>=1.7, <=1.7.1), de.adorsys.aspsp:consent-management-system (>=1.7, <=1.8) +39 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.16.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - de.adorsys.aspsp:aspsp-profile =1.7, =1.7, =1.7, =1.7, =1.7,...

com.oneops:secrets-proxy (>=1.3.0, <=1.5.0), com.swisscom.cloud.sb:broker (>=2.13.0, <=4.0.2) +288 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.13.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.oneops:secrets-proxy =1.3.0, =2.13.0, =4.0.2 -...

de.adorsys.aspsp:aspsp-profile (>=1.2, <=1.6), de.adorsys.aspsp:consent-management-system (>=1.2, <=1.6) +231 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.8.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - de.adorsys.aspsp:aspsp-profile =1.2, =1.2, =1.3, =1.3, =1.2,...

am.ik.home:uaa-server (>=1.3.0, <=1.8.1), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.5) +28 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.1.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - am.ik.home:uaa-server =1.3.0, =1.8.1 -...

com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...

ai.hyacinth.framework:core-service-admin-server (0.5.24), ai.hyacinth.framework:core-service-config-server (0.5.24) +408 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot-devtools MAVEN version =2.0.0.release, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =0.0.2, =0.0.3, =1.0.0, =1.0.5 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 and more Sourc...

com.jayxu:demo (>=0.10.0, <=0.11.0), com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example (>=3.0.9, <=3.1.0) +9 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=4.0.1, <=4.0.3)

org.springframework.boot:spring-boot-devtools MAVEN version =4.0.1, =0.10.0, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =4.0.0, =2.0.0, =2.1.1 - de.tschuehly:spring-view-component-thymeleaf 0.9.1 - io.stereov.singularity:core 1.10.6 - org.flowable:flowable-app-rest 8.0.0 - se.swedenconnect.bankid:bankid-idp...

com.base4j:base4j-demo (>=1.1.8, <=1.3.0), com.base4j:base4j-mvc (>=1.1.8, <=1.3.0) +268 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.9.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.base4j:base4j-demo =1.1.8, =1.1.8, =1.1.8, =1.0.3, =1.0.3...

com.jayxu:demo (>=0.10.0, <=0.11.0), com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example (>=3.0.9, <=3.1.0) +9 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=4.0.1, <=4.0.3)

org.springframework.boot:spring-boot-devtools MAVEN version =4.0.1, =0.10.0, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =4.0.0, =2.0.0, =2.1.1 - de.tschuehly:spring-view-component-thymeleaf 0.9.1 - io.stereov.singularity:core 1.10.6 - org.flowable:flowable-app-rest 8.0.0 - se.swedenconnect.bankid:bankid-idp...

com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...

br.com.m4rc310:br-com-m4rc310-graphql (1.0.1), br.com.m4rc310:br-com-m4rc310-libs (1.0.1) +75 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-devtools MAVEN version =2.7.0, =1.0.2, =1.0.2, =1.0.101, =0.5.0, =3.0.1, =3.0.1, =2.1.6, =2.1.6, =2.1.6, =2.1.6, =2.1.7 and more Source cves: CVE-2026-40972 Source advisory: MEND:CVE-2026-40972...

CVE-2026-40972

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e 2026-04-28 01:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkjf2yw4gh2k 2026-04-28 09:27:42+00:00| seen|...