CVE-2026-40972: High severity VMware Spring Boot vulnerability
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Bootto a version that resolves this vulnerability.Fixed in 4.0.6 - Upgrade
Upgrade
Spring Bootto a version that resolves this vulnerability.Fixed in 3.5.14 - Upgrade
Upgrade
Spring Bootto a version that resolves this vulnerability.Fixed in 3.4.16 - Upgrade
Upgrade
Spring Bootto a version that resolves this vulnerability.Fixed in 3.3.19 - Upgrade
Upgrade
Spring Bootto a version that resolves this vulnerability.Fixed in 2.7.33 - Compensating control
Restrict network access so an attacker cannot be on the same network as the remote application (limit connectivity at the network layer to trusted sources only).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40972?
CVE-2026-40972 is considered a high severity vulnerability because it can lead to remote code execution through a timing attack.
How do I fix CVE-2026-40972?
To fix CVE-2026-40972, upgrade VMware Spring Boot to version 2.7.33 or later, or apply any relevant security patches provided by VMware.
Who is affected by CVE-2026-40972?
CVE-2026-40972 affects multiple versions of VMware Spring Boot, particularly those from versions 2.7.0 up to 2.7.32 and certain 3.x and 4.x versions.
What type of attack is associated with CVE-2026-40972?
CVE-2026-40972 is associated with a timing attack, which can potentially expose sensitive information about remote secrets.
What could happen if CVE-2026-40972 is exploited?
If exploited, CVE-2026-40972 could allow an attacker to determine a secret and upload malicious classes, leading to remote code execution.