CVE-2026-40992: Mail Auto-Configuration Does Not Enable SSL Hostname Verification
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set spring.mail.properties.mail.smtp.ssl.checkserveridentity=true (for example in application.properties or application.yml) to enable JavaMail SSL hostname verification so the application is not affected.
Spring Boot (Mail auto-configuration) spring.mail.properties.mail.smtp.ssl.checkserveridentity = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40992?
The severity of CVE-2026-40992 is rated as medium.
How do I fix CVE-2026-40992?
To fix CVE-2026-40992, set the JavaMail property spring.mail.properties.mail.smtp.ssl.checkserveridentity=true in your application.
Which versions of Spring Boot are affected by CVE-2026-40992?
CVE-2026-40992 affects Spring Boot versions 4.0.0 through 4.0.6, 3.5.0 through 3.5.14, and 3.4.0 and earlier.
What does CVE-2026-40992 impact?
CVE-2026-40992 impacts applications using Spring Boot's Mail auto-configuration that do not enable hostname verification.
What are the risks associated with CVE-2026-40992?
The risks associated with CVE-2026-40992 include the potential for man-in-the-middle attacks due to the lack of SSL hostname verification.