Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40973, CVE-2026-40975, CVE-2026-40977)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40973, CVE-2026-40975, CVE-2026-40977 Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...

ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0, <=0.3.0) +5515 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (>=4.0.0, <=4.0.5)

org.springframework.boot:spring-boot MAVEN version =4.0.0, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-2, =2.0.0 and more Source cves: CVE-2026-40973 Source advisory: OSV:GHSA-WWPQ-F5C3-7HVX...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +691 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.4.release)

org.springframework.boot:spring-boot MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.0, =1.0, =1.0, =1.0.1, =1.0.0, =a.1.0.0,...

au.com.mountain-pass:hyperstate-cert (>=1, <=10), au.com.mountain-pass:hyperstate-client (>=1, <=10) +524 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.0.release)

org.springframework.boot:spring-boot MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.mountain-pass:hyperstate-cert =1, =1, =1, =1, =1, =1, =0.1, =1.0.0-rc,...

au.com.dius:pact-jvm-provider-spring_2.11 (>=3.4.0, <=3.5.18), au.com.dius:pact-jvm-provider-spring_2.12 (>=3.5.4-rc.0, <=3.5.18) +672 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.2.release)

org.springframework.boot:spring-boot MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius:pact-jvm-provider-spring2.11 =3.4.0, =3.5.4-rc.0, =0.9.0, =1.1,...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), cn.chendahai:rocketmq-console-alarm (1.0.3) +335 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.3.release)

org.springframework.boot:spring-boot MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - am.ik.home:uaa-server =1.0.0, =1.0, =1.0.1, =3.0.1.3, =3.0.1.9, =3.0.1.9, =3.0....

cc.ccoke:validate-spring-boot-starter (>=0.1, <=0.5), cc.zenfery:springboot-starter-mds (>=0.1.1, <=0.1.2) +209 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.4.4.release)

org.springframework.boot:spring-boot MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cc.ccoke:validate-spring-boot-starter =0.1, =0.1.1, =0.1.1, =1.23.0, =0.0.2,...

at.researchstudio.sat:won-matcher (0.3), at.researchstudio.sat:won-owner-webapp (0.3) +799 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.3.release)

org.springframework.boot:spring-boot MAVEN version 1.5.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - at.researchstudio.sat:won-matcher 0.3 - at.researchstudio.sat:won-owner-webapp...

am.ik.blog:blog-domain (>=4.2.1, <=4.3.6), am.ik.blog:blog-mapper (>=4.4.1, <=4.5.0) +955 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.7.release)

org.springframework.boot:spring-boot MAVEN version 1.5.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - am.ik.blog:blog-domain =4.2.1, =4.4.1, =0.2.13, =0.2.13, =0.2.13, =0.2.13,...

cn.afterturn:easypoi-spring-boot-starter (>=0.2, <=3.3.0), co.paralleluniverse:comsat-spring-boot (0.5.0) +251 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.5.release)

org.springframework.boot:spring-boot MAVEN version 1.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.afterturn:easypoi-spring-boot-starter =0.2, =1.5.0, =2.0.2, =2.0.3, =2.0.2,...

com.github.jlgrock.snp:client (0.1), com.github.jlgrock.snp:core (0.1) +78 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.0.release)

org.springframework.boot:spring-boot MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.jlgrock.snp:client 0.1 - com.github.jlgrock.snp:core 0.1 -...

com.canoo.dolphin-platform:dolphin-platform-server-spring (>=0.6.1, <=0.8.6), com.canoo.dolphin-platform:dolphin-platform-spring-controller-tester (0.8.6) +183 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.2.release)

org.springframework.boot:spring-boot MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.canoo.dolphin-platform:dolphin-platform-server-spring =0.6.1, =0.6.1, =0.1,...

com.aol.microservices:micro-boot (>=0.64, <=0.72), com.deviceatlas:deviceatlas-spring-mobile-extension (0.1.0) +146 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.2.7.release)

org.springframework.boot:spring-boot MAVEN version 1.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.aol.microservices:micro-boot =0.64, =1.17, =1.25.1-release, =0.1, =1.0,...

au.com.mountain-pass:hyperstate (>=1, <=3), cc.catalysts.boot:cat-boot-cluster (>=0.0.10, <=0.1.14) +196 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.3.2.release)

org.springframework.boot:spring-boot MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.0.10, =0.0.5, =0.0.5, =0.1.8, =0.0.10,...

au.com.dius:pact-jvm-provider-spring_2.11 (>=3.5.19, <=3.5.24), au.com.dius:pact-jvm-provider-spring_2.12 (>=3.5.19, <=3.6.0-rc.0) +742 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.14.release)

org.springframework.boot:spring-boot MAVEN version 1.5.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius:pact-jvm-provider-spring2.11 =3.5.19, =3.5.19, =1.1.10, =1.5.14,...

au.com.dius.pact.provider:spring (>=4.1.0, <=4.1.6), au.com.dius:pact-jvm-provider-spring (>=4.0.0-beta.1, <=4.0.10) +347 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.16.release)

org.springframework.boot:spring-boot MAVEN version 1.5.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - au.com.dius.pact.provider:spring =4.1.0, =4.0.0-beta.1, =3.6.0-rc.1, =3.6.15 -...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure (1.0.2), cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2) +266 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.5.21.release)

org.springframework.boot:spring-boot MAVEN version 1.5.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure 1.0.2 -...

org.springframework.boot:spring-boot-actuator (1.1.0.release), org.springframework.boot:spring-boot-autoconfigure (1.1.0.release) +29 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.0.release)

org.springframework.boot:spring-boot MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - org.springframework.boot:spring-boot-actuator 1.1.0.release -...

com.github.kmbulebu.nicknack:nicknack-server (0.0.4), com.github.relai.vertx.springdata:mod-spring-data (0.5) +44 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.1.5.release)

org.springframework.boot:spring-boot MAVEN version 1.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.github.kmbulebu.nicknack:nicknack-server 0.0.4 -...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +25 more potentially affected by CVE-2026-40973 via org.springframework.boot:spring-boot (1.0.1.release)

org.springframework.boot:spring-boot MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - com.ebay:lightning-client 0.9.0 - com.ebay:lightning-core 0.9.0 -...