CVE-2026-40992

CVE-2026-40992 concerns Spring Boot's Mail auto-configuration not enabling hostname verification by default. Affected: Spring Boot 4.0.0–4.0.6; 3.5.0–3.5.14; 3.4.0–3.4.16. The issue: hostname verification is not enabled; applications that explicitly set spring.mail.properties.mail.smtp.ssl.checks...

CVE-2026-40992 Mail Auto-Configuration Does Not Enable SSL Hostname Verification

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

CVE-2026-40992

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

EUVD-2026-36203

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

CVE-2026-40992 Mail Auto-Configuration Does Not Enable SSL Hostname Verification

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

cc.cloudpivot.starter:cloudpivot-starter-messaging-mail (>=1.0.0, <=1.0.3), cn.net.rjnetwork:social-sdk-xianyu-manager (>=0.0.2, <=0.0.7) +523 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=3.5.0, <=3.5.14)

org.springframework.boot:spring-boot-starter-mail MAVEN version =3.5.0, =1.0.0, =0.0.2, =3.5.5, =0.0.19, =0.0.19, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.11.6, =4.12.0 and more Source cves: CVE-2026-40992 Source advisory: MEND:CVE-2026-40992...

cl.kanopus.tool:ktool-pulse (>=1.0.0, <=2.1.0), cloud.lildworks.ldu.springboot:ldu-springboot-mail-sender (4.0.6.2606.0) +336 more potentially affected by CVE-2026-40992 via org.springframework.boot:spring-boot-starter-mail (>=4.0.0, <=4.0.6)

org.springframework.boot:spring-boot-starter-mail MAVEN version =4.0.0, =1.0.0, =v2.0.0, =2.83.0, =2.79.0, =2.78.0, =2.71.0, =2.74.0, =3.33.0, =2.70.0, =1.52.0, =5.0.4, =4.8.0-chi-rc, =4.8.2-chi and more Source cves: CVE-2026-40992 Source advisory: MEND:CVE-2026-40992...

EUVD-2026-36202

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through...

CVE-2026-40987

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through...

CVE-2026-40987 Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through...

CVE-2026-40987 Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through...

CVE-2026-40987 Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through...

io.awspring.cloud:spring-cloud-aws-starter-integration-s3 (>=4.0.0-rc1, <=4.0.2), org.eclipse.dirigible:dirigible-components-engine-ftp (>=12.94.0, <=13.5.0) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.0.0, <=7.0.4)

org.springframework.integration:spring-integration-file MAVEN version =7.0.0, =4.0.0-rc1, =12.94.0, =13.5.0 - org.springframework.cloud.fn:spring-aws-s3-common 6.0.0 - org.springframework.cloud.fn:spring-file-common 6.0.0 - org.springframework.cloud.fn:spring-file-consumer 6.0.0 -...

cn.herodotus.engine:message-sdk-mqtt (>=3.5.0.0, <=3.5.5.2), cn.herodotus.engine:message-spring-boot-starter (>=3.5.0.0, <=3.5.5.2) +24 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=6.5.0, <=6.5.8)

org.springframework.integration:spring-integration-file MAVEN version =6.5.0, =3.5.0.0, =3.5.0.0, =2.0.0-milestone-06, =2.0.0-milestone-06, =2.0.0-milestone-06, =2.0.0-milestone-06, =2.0.0-milestone-06, =11.47.0, =12.91.0 - org.springframework.cloud.fn:spring-aws-s3-common 5.2.0 -...

CVE-2026-40987

CVE-2026-40987 affects Spring Integration across multiple tracked branches (7.0.0–7.0.4, 6.5.0–6.5.8, 6.4.0–6.4.11, 6.3.0–6.3.14, 5.5.0–5.5.20). The connected documents describe a vulnerability where a malicious or compromised FTP/SFTP/SMB server can cause the client to write arbitrary files anyw...

CVE-2026-40986 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

CVE-2026-40986 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

EUVD-2026-36201

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

CVE-2026-40986 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

CVE-2026-40986

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...