GHSA-M4X9-HX6X-2C43 Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15...

GHSA-WWPQ-F5C3-7HVX Spring Boot accepts predictable temp directory without ownership verification

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack...

GHSA-MQVW-JFMH-93QQ Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14, 3.4.0–3.4.15 fix 3.4.16, 3.3.0–3.3.18 fix 3.3.19, 2.7.0–2.7.32 fix 2.7.33; Cassandra SSL...

com.github.advantageous:qbit-spring (>=0.9.1-rc11, <=0.9.2-rc14), com.github.jmgilmour:parker-spring-boot (0.1.0) +165 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.6.release)

org.springframework.boot:spring-boot MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.advantageous:qbit-spring =0.9.1-rc11, =2.0.1, =2.2.29, =1.0.4, =1.0....

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-application (>=1.0.0, <=1.2.0) +36904 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=2.0.0.release, <=2.7.18)

org.springframework.boot:spring-boot MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.0, =4.6.0.0 and more Source cves: CVE-2026-40973 Source advisory: GHSA-WWPQ-F5C3-7HVX...

cn.allbs:allbs-dynamic-db (>=1.0.0, <=1.1.5), cn.home1:logback-example (>=0.0.8.oss, <=0.1.1) +907 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.12.release)

org.springframework.boot:spring-boot MAVEN version 1.5.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.allbs:allbs-dynamic-db =1.0.0, =0.0.8.oss, =0.0.1, =0.0.1, =0.0.1, =0.0.1,...

ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone (>=0.7, <=0.8), cn.bestwu:starter-logging (>=0.1.6-v1, <=1.0.0) +867 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.10.release)

org.springframework.boot:spring-boot MAVEN version 1.5.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone =0.7, =0.1.6-v1, =1.0.1,...

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), cn.home1:oss-configlint (1.0.6.oss) +1234 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.1.release)

org.springframework.boot:spring-boot MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.6.oss, =1.0.6.oss, =1.0.7.oss, =1.0.7.oss,...

cn.skylarkai:license (>=1.0.0, <=1.0.2), com.eworkcloud:ework-cloud-starter-web (>=1.0.0, <=1.8.1) +175 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.20.release)

org.springframework.boot:spring-boot MAVEN version 1.5.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.skylarkai:license =1.0.0, =1.0.0, =3.1.1.release, =2.2.0.release,...

com.foreach.across.modules:admin-web-module (1.1.1.release), com.foreach.across.modules:debug-web-module (1.0.1.release) +131 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.8.release)

org.springframework.boot:spring-boot MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.foreach.across.modules:admin-web-module 1.1.1.release -...

am.ik.home:uaa-server (>=1.3.0, <=1.8.1), br.jus.stf.digital:core (>=0.2.0, <=1.6.0) +320 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.1.release)

org.springframework.boot:spring-boot MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - am.ik.home:uaa-server =1.3.0, =0.2.0, =6.2.0.5, =6.2.0.6, =6.2.0.4, =6.2.0.5,...

com.erudika:para (1.8.0), com.github.totyumengr:minicubes-cluster (0.2) +55 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.4.release)

org.springframework.boot:spring-boot MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.erudika:para 1.8.0 - com.github.totyumengr:minicubes-cluster 0.2 -...

com.blitline:blitline-image-client-example (>=0.10.1, <=0.13.3), com.erudika:para (>=1.3.0, <=1.7.0) +37 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.0.2.release)

org.springframework.boot:spring-boot MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.blitline:blitline-image-client-example =0.10.1, =1.3.0, =1.1.0.beta5,...

com.alibaba.boot:dubbo-spring-boot-starter (0.1.2.release), com.foreach.across:across-core (3.1.2.release) +223 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.18.release)

org.springframework.boot:spring-boot MAVEN version 1.5.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.alibaba.boot:dubbo-spring-boot-starter 0.1.2.release -...

co.fingerprintsoft:notification-spring-boot-autoconfigure (1.0.6), co.fingerprintsoft:notification-spring-boot-starter (1.0.6) +70 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.3.4.release)

org.springframework.boot:spring-boot MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - co.fingerprintsoft:notification-spring-boot-autoconfigure 1.0.6 -...

at.researchstudio.sat:won-matcher (0.3), at.researchstudio.sat:won-owner-webapp (0.3) +799 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.3.release)

org.springframework.boot:spring-boot MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - at.researchstudio.sat:won-matcher 0.3 - at.researchstudio.sat:won-owner-webapp...

ch.sbb.releasetrain:action (0.0.25), ch.sbb.releasetrain:config (0.0.25) +229 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.3.6.release)

org.springframework.boot:spring-boot MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ch.sbb.releasetrain:action 0.0.25 - ch.sbb.releasetrain:config 0.0.25 -...

com.vilt-group.minium:minium-app (0.9.6), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +36 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.7.release)

org.springframework.boot:spring-boot MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.vilt-group.minium:minium-app 0.9.6 - de.codecentric:jbehave-admin-server...

Spring Boot accepts predictable temp directory without ownership verification

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack...

ca.appsimulations:jlqninterface (>=1.0.0, <=1.1.0), ca.appsimulations:models (>=1.0.2, <=3.0.4) +1287 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.9.release)

org.springframework.boot:spring-boot MAVEN version 1.5.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ca.appsimulations:jlqninterface =1.0.0, =1.0.2, =1.0.5, =0.0.1-release,...