Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40973, CVE-2026-40975, CVE-2026-40977)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40973, CVE-2026-40975, CVE-2026-40977 Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +691 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.4.release)

org.springframework.boot:spring-boot MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0, =1.0, =1.0, =1.0.1, =1.0.0, =a.1.0.0,...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +9122 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

com.canoo.dolphin-platform:dolphin-platform-server-spring (>=0.6.1, <=0.8.6), com.canoo.dolphin-platform:dolphin-platform-spring-controller-tester (0.8.6) +183 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.2.release)

org.springframework.boot:spring-boot MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.canoo.dolphin-platform:dolphin-platform-server-spring =0.6.1, =0.6.1, =0.1,...

org.springframework.boot:spring-boot-actuator (1.1.0.release), org.springframework.boot:spring-boot-autoconfigure (1.1.0.release) +29 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.0.release)

org.springframework.boot:spring-boot MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - org.springframework.boot:spring-boot-actuator 1.1.0.release -...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), cn.chendahai:rocketmq-console-alarm (1.0.3) +335 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.3.release)

org.springframework.boot:spring-boot MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - am.ik.home:uaa-server =1.0.0, =1.0, =1.0.1, =3.0.1.3, =3.0.1.9, =3.0.1.9, =3.0....

at.researchstudio.sat:won-matcher (0.3), at.researchstudio.sat:won-owner-webapp (0.3) +799 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.3.release)

org.springframework.boot:spring-boot MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - at.researchstudio.sat:won-matcher 0.3 - at.researchstudio.sat:won-owner-webapp...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0, <=0.120.0) +9122 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.29 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +5498 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot MAVEN version =4.0.0, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-2, =2.0.0 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

am.ik.blog:blog-domain (>=4.2.1, <=4.3.6), am.ik.blog:blog-mapper (>=4.4.1, <=4.5.0) +955 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.7.release)

org.springframework.boot:spring-boot MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - am.ik.blog:blog-domain =4.2.1, =4.4.1, =0.2.13, =0.2.13, =0.2.13, =0.2.13,...

au.com.dius:pact-jvm-provider-spring_2.11 (>=3.4.0, <=3.5.18), au.com.dius:pact-jvm-provider-spring_2.12 (>=3.5.4-rc.0, <=3.5.18) +672 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.2.release)

org.springframework.boot:spring-boot MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius:pact-jvm-provider-spring2.11 =3.4.0, =3.5.4-rc.0, =0.9.0, =1.1,...

cc.ccoke:validate-spring-boot-starter (>=0.1, <=0.5), cc.zenfery:springboot-starter-mds (>=0.1.1, <=0.1.2) +209 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.4.release)

org.springframework.boot:spring-boot MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cc.ccoke:validate-spring-boot-starter =0.1, =0.1.1, =0.1.1, =1.23.0, =0.0.2,...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10513 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

au.com.mountain-pass:hyperstate (>=1, <=3), cc.catalysts.boot:cat-boot-cluster (>=0.0.10, <=0.1.14) +196 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.3.2.release)

org.springframework.boot:spring-boot MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.0.10, =0.0.5, =0.0.5, =0.1.8, =0.0.10,...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8589 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

com.github.jlgrock.snp:client (0.1), com.github.jlgrock.snp:core (0.1) +78 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.0.release)

org.springframework.boot:spring-boot MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.jlgrock.snp:client 0.1 - com.github.jlgrock.snp:core 0.1 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10513 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

CVE-2026-40973

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10513 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40973 Source advisory: MEND:CVE-2026-40973...

CVE-2026-40973

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e 2026-04-28 09:27:42+00:00| seen| https://ccb.belgium.be/advisories/warning-multiple-vulnerabilities-spring-boot-patch-immediately...