CVE-2026-40970: Medium severity VMware Spring Boot vulnerability
When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40970?
CVE-2026-40970 has a medium severity rating due to its impact on hostname verification in secure communications.
How do I fix CVE-2026-40970?
To fix CVE-2026-40970, upgrade Spring Boot from versions 4.0.0 to 4.0.5 to version 4.0.6 or later.
What versions of Spring Boot are affected by CVE-2026-40970?
CVE-2026-40970 affects Spring Boot versions 4.0.0 to 4.0.5.
What is the potential impact of CVE-2026-40970?
The potential impact of CVE-2026-40970 is the risk of Man-in-the-Middle (MitM) attacks due to the lack of hostname verification.
Is hostname verification important in Spring Boot's Elasticsearch configuration?
Yes, hostname verification is crucial to ensure secure connections and prevent malicious interception in Spring Boot's Elasticsearch configuration.