CVE-2023-34055

CVE-2023-34055 concerns denial-of-service in Spring Boot when using Spring MVC/WebFlux and the actuator JAR on the classpath. Affected are Spring Boot versions 2.7.0–2.7.17, 3.0.0–3.0.12, and 3.1.0–3.1.5. The DoS condition arises from specially crafted HTTP requests; exploitation requires the aff...

CVE-2026-40977

The CVE affects Spring Boot’s ApplicationPidFileWriter PID-file handling. A local attacker with write access to the PID-file location can clobber a host file on each startup. Affected versions include Spring Boot 4.0.0–4.0.5 (fixed in 4.0.6), 3.5.0–3.5.13 (fixed in 3.5.14), 3.4.0–3.4.15 (fixed in...

CVE-2026-40970

CVE-2026-40970 : When Spring Boot is configured to use an SSL bundle, its Elasticsearch auto-configuration does not perform hostname verification during TLS connections to the Elasticsearch server. Affected: Spring Boot 4.0.0–4.0.5. Impact: potential MitM if an attacker presents a valid CA-signed...