com.avioconsulting.maven:ics-maven-plugin (1.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.2, <=0.0.5) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.avioconsulting.maven:ics-maven-plugin 1.0 -...

com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...

com.jayxu:demo (>=0.10.0, <=0.11.0), com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example (>=3.0.9, <=3.1.0) +9 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=4.0.1, <=4.0.3)

org.springframework.boot:spring-boot-devtools MAVEN version =4.0.1, =0.10.0, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =4.0.0, =2.0.0, =2.1.1 - de.tschuehly:spring-view-component-thymeleaf 0.9.1 - io.stereov.singularity:core 1.10.6 - org.flowable:flowable-app-rest 8.0.0 - se.swedenconnect.bankid:bankid-idp...

com.didispace:scca-ui (>=1.0.0-release, <=1.1.1-release), com.foreach.across.modules:dynamic-forms-module (0.0.1.release) +270 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.14.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.didispace:scca-ui =1.0.0-release, =4.0.3, =5.3.1, =5.3.1...

br.com.m4rc310:br-com-m4rc310-gql (>=1.0.42, <=1.0.45), br.com.m4rc310:br-com-m4rc310-gtim (>=1.0.42, <=1.0.45) +33 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.3.0, <=3.3.7)

org.springframework.boot:spring-boot-devtools MAVEN version =3.3.0, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =4.0.0, =4.0.0, =1.6.0, =1.0.7, =1.0.8 and more Source cves: CVE-2026-40972 Source advisory: GHSA-56V8-86GJ-66JP...

com.garethahealy.poms:camel-on-springboot-parent (1.0.5), com.garethahealy.poms:springboot-parent (>=1.0.1, <=1.0.5) +142 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.1.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.garethahealy.poms:camel-on-springboot-parent 1.0.5 -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.10, <=2.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=1.0.10, <=2.0.4) +223 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

org.camunda.bpm.extension.example:camunda-bpm-spring-boot-starter-example-simple (1.2.1) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.oneops:secrets-proxy (>=1.3.0, <=1.5.0), com.swisscom.cloud.sb:broker (>=2.13.0, <=4.0.2) +288 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.13.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.oneops:secrets-proxy =1.3.0, =2.13.0, =4.0.2 -...

com.swisscom.cloud.sb:broker (>=2.11.2, <=2.12.1), edu.wisc.my.apps:lti-proxy (>=1.0.1, <=2.0.1) +116 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.swisscom.cloud.sb:broker =2.11.2, =1.0.1, =1.0.3, =0.0.1,...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +4 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.4.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.oneops:secrets-proxy (>=1.2.0, <=1.2.1), net.onebean:net.onebean.core (>=1.1.0.4.release, <=1.1.0.5.release) +228 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.12.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.oneops:secrets-proxy =1.2.0, =1.1.0.4.release, =3.6.1,...

br.com.m4rc310:br-com-m4rc310-gql (>=1.0.42, <=1.0.45), br.com.m4rc310:br-com-m4rc310-gtim (>=1.0.42, <=1.0.45) +33 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.3.0, <=3.3.7)

org.springframework.boot:spring-boot-devtools MAVEN version =3.3.0, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =4.0.0, =4.0.0, =1.6.0, =1.0.7, =1.0.8 and more Source cves: CVE-2026-40972 Source advisory: OSV:GHSA-56V8-86GJ-66JP...

org.springframework.boot:spring-boot-docs (1.4.5.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.4.5.release Sourc...

org.springframework.boot:spring-boot-docs (1.4.6.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.4.6.release Sourc...

Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

com.jayxu:demo (>=0.10.0, <=0.11.0), com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example (>=3.0.9, <=3.1.0) +9 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=4.0.1, <=4.0.3)

org.springframework.boot:spring-boot-devtools MAVEN version =4.0.1, =0.10.0, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =4.0.0, =2.0.0, =2.1.1 - de.tschuehly:spring-view-component-thymeleaf 0.9.1 - io.stereov.singularity:core 1.10.6 - org.flowable:flowable-app-rest 8.0.0 - se.swedenconnect.bankid:bankid-idp...

br.com.m4rc310:br-com-m4rc310-gql (>=1.0.42, <=1.0.45), br.com.m4rc310:br-com-m4rc310-gtim (>=1.0.42, <=1.0.45) +33 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.3.0, <=3.3.7)

org.springframework.boot:spring-boot-devtools MAVEN version =3.3.0, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =4.0.0, =4.0.0, =1.6.0, =1.0.7, =1.0.8 and more Source cves: CVE-2026-40972 Source advisory: MEND:CVE-2026-40972...

com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...

br.com.m4rc310:br-com-m4rc310-graphql (1.0.1), br.com.m4rc310:br-com-m4rc310-libs (1.0.1) +75 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=2.7.0, <=2.7.18)

org.springframework.boot:spring-boot-devtools MAVEN version =2.7.0, =1.0.2, =1.0.2, =1.0.101, =0.5.0, =3.0.1, =3.0.1, =2.1.6, =2.1.6, =2.1.6, =2.1.6, =2.1.7 and more Source cves: CVE-2026-40972 Source advisory: MEND:CVE-2026-40972...