Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

cc.cloudpivot.starter:cloudpivot-starter-messaging-mail (>=1.0.0, <=1.0.3), cn.net.rjnetwork:social-sdk-xianyu-manager (>=0.0.2, <=0.0.7) +523 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-starter-mail MAVEN version =3.5.0, =1.0.0, =0.0.2, =3.5.5, =0.0.19, =0.0.19, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.12.0 and more Source cves: CVE-2026-40992 Source advisory: GHSA-9WXP-W4PX-32VH...

cl.kanopus.tool:ktool-pulse (>=1.0.0, <=2.1.0), cloud.lildworks.ldu.springboot:ldu-springboot-mail-sender (4.0.6.2606.0) +336 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-starter-mail MAVEN version =4.0.0, =1.0.0, =v2.0.0, =2.83.0, =2.79.0, =2.78.0, =2.71.0, =2.74.0, =3.33.0, =2.70.0, =1.52.0, =5.0.4, =4.8.0-chi-rc, =4.8.2-chi and more Source cves: CVE-2026-40992 Source advisory: GHSA-9WXP-W4PX-32VH...

org.springframework.boot:spring-boot-starter-integration (1.1.10.release), org.springframework.integration:spring-integration-ftp (4.0.5.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.0.5.release)

org.springframework.integration:spring-integration-file MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (4.1.7.release), org.springframework.integration:spring-integration-sftp (4.1.7.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.1.7.release)

org.springframework.integration:spring-integration-file MAVEN version 4.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.batch:spring-batch-admin-manager (>=1.2.1.release, <=1.2.2.release), org.springframework.integration:spring-integration-ftp (2.0.3.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.0.3.release)

org.springframework.integration:spring-integration-file MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (4.3.5.release), org.springframework.integration:spring-integration-sftp (4.3.5.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.5.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

com.themodernway:themodernway-server-core (1.1.0-release), com.themodernway:themodernway-server-mongodb (1.1.0-release) +3 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.11.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.themodernway:themodernway-server-cor...

io.awspring.cloud:spring-cloud-aws-starter-integration-s3 (>=4.0.0-rc1, <=4.0.2), org.eclipse.dirigible:dirigible-components-engine-ftp (>=12.94.0, <=13.5.0) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.0.0, <=7.0.4)

org.springframework.integration:spring-integration-file MAVEN version =7.0.0, =4.0.0-rc1, =12.94.0, =13.5.0 - org.springframework.cloud.fn:spring-aws-s3-common 6.0.0 - org.springframework.cloud.fn:spring-file-common 6.0.0 - org.springframework.cloud.fn:spring-file-consumer 6.0.0 -...

cc.cloudpivot.starter:cloudpivot-starter-messaging-mail (>=1.0.0, <=1.0.3), cn.net.rjnetwork:social-sdk-xianyu-manager (>=0.0.2, <=0.0.7) +523 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-starter-mail MAVEN version =3.5.0, =1.0.0, =0.0.2, =3.5.5, =0.0.19, =0.0.19, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.12.0 and more Source cves: CVE-2026-40992 Source advisory: OSV:GHSA-9WXP-W4PX-32VH...

cl.kanopus.tool:ktool-pulse (>=1.0.0, <=2.1.0), cloud.lildworks.ldu.springboot:ldu-springboot-mail-sender (4.0.6.2606.0) +336 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-starter-mail MAVEN version =4.0.0, =1.0.0, =v2.0.0, =2.83.0, =2.79.0, =2.78.0, =2.71.0, =2.74.0, =3.33.0, =2.70.0, =1.52.0, =5.0.4, =4.8.0-chi-rc, =4.8.2-chi and more Source cves: CVE-2026-40992 Source advisory: OSV:GHSA-9WXP-W4PX-32VH...

ai.intelliswarm:swarmai-eval (>=1.0.0, <=1.0.29), ai.intelliswarm:swarmai-rag (>=1.0.28, <=1.0.29) +472 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-starter-mail MAVEN version =3.4.0, =1.0.0, =1.0.28, =1.0.0, =3.2.5, =5.0.0-beta.4, =1.0.0, =1.0.1-jdk21, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.3, =4.11.5 and more Source cves: CVE-2026-40992 Source advisory: OSV:GHSA-9WXP-W4PX-32...

com.themodernway:themodernway-server-integration (1.3.5-release), org.springframework.cloud:spring-cloud-dataflow-docs (>=1.5.0.release, <=1.5.2.release) +10 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.14.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.apereo.cas:cas-server-core (>=8.0.0-rc1, <=8.0.0-rc5), org.apereo.cas:cas-server-core-api (>=8.0.0-rc1, <=8.0.0-rc5) +342 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (4.0.0)

org.springframework.webflow:spring-webflow MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.webflow:spring-webflow and may be impacted: - org.apereo.cas:cas-server-core =8.0.0-rc1, =8.0.0-rc1, =8.0.0-rc1,...

org.springframework.integration:spring-integration-ftp (2.2.7.release), org.springframework.integration:spring-integration-sftp (2.2.7.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.2.7.release)

org.springframework.integration:spring-integration-file MAVEN version 2.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.boot:spring-boot-starter-integration (1.3.6.release), org.springframework.integration:spring-integration-ftp (4.2.8.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.8.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

com.javaetmoi.core:spring-batch-toolkit (>=1.0.0, <=1.0.1), net.gplatform:sudoor-server-lib (1.0.13) +3 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.1.1.release)

org.springframework.integration:spring-integration-file MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.javaetmoi.core:spring-batch-toolkit...

io.awspring.cloud:spring-cloud-aws-starter-integration-s3 (>=4.0.0-rc1, <=4.0.2), org.eclipse.dirigible:dirigible-components-engine-ftp (>=12.94.0, <=13.5.0) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.0.0, <=7.0.4)

org.springframework.integration:spring-integration-file MAVEN version =7.0.0, =4.0.0-rc1, =12.94.0, =13.5.0 - org.springframework.cloud.fn:spring-aws-s3-common 6.0.0 - org.springframework.cloud.fn:spring-file-common 6.0.0 - org.springframework.cloud.fn:spring-file-consumer 6.0.0 -...

com.mozu:mozu-api-jobs (>=1.0.13, <=1.0.23), gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1, <=0.0.8) +5 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (3.0.2.release)

org.springframework.integration:spring-integration-file MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.mozu:mozu-api-jobs =1.0.13, =0.0.1,...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.webapp.modules:cloud-altemistafwk-webapp-jsf-conf (>=3.0.0.release, <=3.1.0.release) +733 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (>=2.0.6.release, <=2.5.1.release)

org.springframework.webflow:spring-webflow MAVEN version =2.0.6.release, =3.0.0.release, =3.0.0.release, =2.0.0, =2.3.0, =2.1.0, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =0.0.1, =5.1.3, =5.3.4 and more Source cves: CVE-2026-40986 Source advisory: OSV:GHSA-HW5C...