Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40974)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40974 Vulnerability Details CVEID:CVE-2026-40974 DESCRIPTION: Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spri...

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Certificate Validation (CVE-2026-40971, CVE-2026-40974)

Summary There are vulnerabilities in spring-boot-autoconfigure-3.5.12.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40971, CVE-2026-40974. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-40971 DESCRIPTION: When configured to use an SSL bundle,...

Security Bulletin: Due to use of spring-boot-autoconfigure-3.5.13.jar, IBM Sterling Connect:Direct Web Services is vulnerable to not perform hostname verification.

Summary spring-boot-autoconfigure-3.5.13.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-40971, CVE-2026-40974. Vulnerability Details CVEID:CVE-2026-40971 DESCRIPTION: When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

ai.apiverse:apipulse (1.0.1), ai.chat2db.excel:easyexcel-plus-test (0.0.1) +13644 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-autoconfigure (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =2.7.0, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =0.18, =1.0, =0.8.38, =0.8.38, =v0.16.1, =v0.16.1, =v0.16.1, =v0.123.652 and more Source cves: CVE-2026-40974 Source advisory: MEND:CVE-2026-40974...

CVE-2026-40974

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16, 3.3.0–3.3.18 fix 3.3.19, 2.7.0–2.7.32 fix 2.7.33; Cassandra SSL...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0) +8388 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-autoconfigure (>=3.3.0, <=3.3.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.3.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-40974 Source advisory: MEND:CVE-2026-40974...

com.devskiller.friendly-id:friendly-id-openfeign (>=2.0.0-alpha3, <=2.0.0-beta6), io.github.bluetape4k:bluetape4k-spring-boot4-cassandra (>=1.5.0-beta2, <=1.7.0) +19 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-cassandra (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot-cassandra MAVEN version =4.0.0, =2.0.0-alpha3, =1.5.0-beta2, =0.8.0, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +10285 more potentially affected by CVE-2026-40974 via org.springframework.boot:spring-boot-autoconfigure (>=3.5.0, <=3.5.13)

org.springframework.boot:spring-boot-autoconfigure MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =0.3.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.8.4 and more Source cves: CVE-2026-40974 Source advisory: MEND:CVE-2026-40974...

CVE-2026-40974

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16, 3.3.0–3.3.18 fix 3.3.19, 2.7.0–2.7.32 fix 2.7.33; Cassandra SSL...

CVE-2026-40974

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanfgg2pj2e 2026-06-12 12:55:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mo3ry7mosb27...