RHLW-2026-847D178EF0F52697 Lightwell Security Advisory: spring-boot-devtools 2.7.18.rhlw-00004

Red Hat Lightwell has released org.springframework.boot:spring-boot-devtools 2.7.18.rhlw-00004 with a backported security fix. CVE-2026-40972: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extre...

ROOT-APP-MAVEN-CVE-2026-40972 CVE-2026-40972 in org.springframework.boot:spring-boot-devtools - Patched by Root

Root has patched CVE-2026-40972 in the org.springframework.boot:spring-boot-devtools package for Root:Maven. Multiple fixed versions available...

CVE-2026-59327

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327: Cleartext Storage of Sensitive Information

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

cve-2026-59327 - MEDIUM - CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison

A flaw was found in Spring Boot. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about a remote secret. In extreme circumstances, this could allow the attacker to determine the secret and upload changed classes, leading to...

no.skatteetaten.aurora.springboot:aurora-spring-boot-starter (3.6.0), org.apache.skywalking:apache-skywalking-apm (>=6.1.0, <=6.4.0) +3 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.11.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - no.skatteetaten.aurora.springboot:aurora-spring-boot-starter...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=1.0.7, <=2.0.3), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=1.0.7, <=2.0.3) +174 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.digitalsanctuary:ds-spring-user-framework (>=3.2.3, <=3.3.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.1.0, <=4.1.1) +42 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.5.0, <=3.5.11)

org.springframework.boot:spring-boot-devtools MAVEN version =3.5.0, =3.2.3, =4.1.0, =3.0.2g, =3.2.2, =1.1.1, =1.2.0 - de.tschuehly:spring-view-component-thymeleaf 0.9.0 - io.gitee.javakiller:wxz-common 2026.08.30-jdk17 - io.gitee.javakiller:wxz-common-web 2026.08.30-jdk17 -...

com.jayxu:demo (>=0.10.0, <=0.11.0), com.okta.spring.examples:okta-spring-boot-hosted-code-flow-example (>=3.0.9, <=3.1.0) +9 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=4.0.1, <=4.0.3)

org.springframework.boot:spring-boot-devtools MAVEN version =4.0.1, =0.10.0, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =4.0.0, =2.0.0, =2.1.1 - de.tschuehly:spring-view-component-thymeleaf 0.9.1 - io.stereov.singularity:core 1.10.6 - org.flowable:flowable-app-rest 8.0.0 - se.swedenconnect.bankid:bankid-idp...

com.didispace:scca-ui (>=1.0.0-release, <=1.1.1-release), com.foreach.across.modules:dynamic-forms-module (0.0.1.release) +270 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.14.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.didispace:scca-ui =1.0.0-release, =4.0.3, =5.3.1, =5.3.1...

br.com.m4rc310:br-com-m4rc310-gql (>=1.0.42, <=1.0.45), br.com.m4rc310:br-com-m4rc310-gtim (>=1.0.42, <=1.0.45) +33 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=3.3.0, <=3.3.7)

org.springframework.boot:spring-boot-devtools MAVEN version =3.3.0, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =1.0.42, =4.0.0, =4.0.0, =1.6.0, =1.0.7, =1.0.8 and more Source cves: CVE-2026-40972 Source advisory: GHSA-56V8-86GJ-66JP...

com.garethahealy.poms:camel-on-springboot-parent (1.0.5), com.garethahealy.poms:springboot-parent (>=1.0.1, <=1.0.5) +142 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.1.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.garethahealy.poms:camel-on-springboot-parent 1.0.5 -...

org.springframework.boot:spring-boot-docs (1.5.5.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.5.release Sourc...

com.foreach.across.modules:dynamic-forms-module (0.0.3.release), com.github.weijj0528:springboot-starter (1.5.20) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.20.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.foreach.across.modules:dynamic-forms-module 0.0.3.releas...

com.github.wanggit:access-frequency-spring-boot-starter (>=1.0.0, <=1.0.1-snapshots), com.github.xiaoping1988.spring.boot:mybatis-ping-spring-boot (1.0.1) +229 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.github.wanggit:access-frequency-spring-boot-starter =1.0....

com.base4j:base4j-demo (>=1.1.8, <=1.3.0), com.base4j:base4j-mvc (>=1.1.8, <=1.3.0) +268 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.9.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.base4j:base4j-demo =1.1.8, =1.1.8, =1.1.8, =1.0.3, =1.0.3...

org.apereo.cas:cas-server-core-api (>=5.3.7, <=5.3.16), org.apereo.cas:cas-server-core-api-authentication (>=5.3.7, <=5.3.16) +28 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.18.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.apereo.cas:cas-server-core-api =5.3.7, =5.3.7, =5.3.7,...

ai.hyacinth.framework:core-service-admin-server (0.5.24), ai.hyacinth.framework:core-service-config-server (0.5.24) +408 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot-devtools MAVEN version =2.0.0.release, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =0.0.2, =0.0.3, =1.0.0, =1.0.5 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 and more Sourc...