ROOT-APP-MAVEN-CVE-2026-40972 CVE-2026-40972 in org.springframework.boot:spring-boot-devtools - Patched by Root

Root has patched CVE-2026-40972 in the org.springframework.boot:spring-boot-devtools package for Root:Maven. Multiple fixed versions available...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327: Cleartext Storage of Sensitive Information

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

cve-2026-59327 - MEDIUM - CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison

A flaw was found in Spring Boot. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about a remote secret. In extreme circumstances, this could allow the attacker to determine the secret and upload changed classes, leading to...

org.springframework.boot:spring-boot-docs (1.5.0.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.5.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.5.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.5.0.release Sourc...

com.alibaba:tac-console (0.0.4), com.alibaba:tac-container (0.0.4) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.alibaba:tac-console 0.0.4 - com.alibaba:tac-container 0.0...

org.springframework.boot:spring-boot-docs (1.4.6.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.4.6.release Sourc...

org.springframework.boot:spring-boot-docs (1.4.5.release) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - org.springframework.boot:spring-boot-docs 1.4.5.release Sourc...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (1.0.4) +4 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.4.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.swisscom.cloud.sb:broker (>=2.11.2, <=2.12.1), edu.wisc.my.apps:lti-proxy (>=1.0.1, <=2.0.1) +116 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.swisscom.cloud.sb:broker =2.11.2, =1.0.1, =1.0.3, =0.0.1,...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (0.0.16), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.16) +103 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

io.fabric8:fabric8-maven-generator-spring-boot (>=3.1.66, <=3.1.70), io.fabric8:fabric8-maven-plugin (>=3.1.65, <=3.1.70) +1 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.7.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - io.fabric8:fabric8-maven-generator-spring-boot =3.1.66,...

org.camunda.bpm.extension.example:camunda-bpm-spring-boot-starter-example-simple (1.2.1) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.6.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.10, <=0.0.14), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.10, <=0.0.14) +10 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.8, <=0.0.9), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.8, <=0.0.9) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.2.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...

com.avioconsulting.maven:ics-maven-plugin (1.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (>=0.0.2, <=0.0.5) potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.0.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.avioconsulting.maven:ics-maven-plugin 1.0 -...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (1.0.3) +25 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.3.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - am.ik.home:uaa-server =1.0.0, =1.2.0 -...

com.garethahealy.poms:camel-on-springboot-parent (1.0.5), com.garethahealy.poms:springboot-parent (>=1.0.1, <=1.0.5) +142 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.4.1.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: - com.garethahealy.poms:camel-on-springboot-parent 1.0.5 -...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (0.0.15), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter-example (0.0.15) +67 more potentially affected by CVE-2026-40972 via org.springframework.boot:spring-boot-devtools (1.3.5.release)

org.springframework.boot:spring-boot-devtools MAVEN version 1.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-devtools and may be impacted: -...