IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
5.0Mittel

CVE-2026-40970

Spring Spring Boot Veröffentlicht: (vor 6 Monaten)

Beschreibung

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Schwachstellentyp (CWE): CWE-295

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Spring Spring Boot 4.0.0 – < 4.0.6
vmware spring boot 4.0.0 – < 4.0.6

Referenzen und Patches

CPE-Treffer (NVD) (1)
  • cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* ≥ 4.0.0 < 4.0.6

Neue CVEs im selben Produkt — Spring Framework / Boot

3.7Niedrig
CVE-2026-59314

Spring Framework response splitting in ContentDisposition

Spring Spring Framework

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.2…

6.1Mittel
CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring Spring Framework

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScrip…