Vulnerability-Lookup

CVE-2026-40975 (GCVE-0-2026-40975)

Vulnerability from cvelistv5 – Published: 2026-04-27 23:32 – Updated: 2026-07-15 01:00

Summary

Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-330 - Use of Insufficiently Random Values
CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Assigner

vmware

References

8 references

URL	Tags
https://spring.io/security/cve-2026-40975
https://access.redhat.com/security/cve/CVE-2026-40975	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2463331	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:25089	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22619	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21772	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17668	vendor-advisoryx_refsource_REDHAT

Impacted products

17 products

Vendor	Product	Version
Spring	Spring Boot	Affected: 4.0.0 , < 4.0.6 (custom) Affected: 3.5.0 , < 3.5.14 (custom) Affected: 3.4.0 , < 3.4.16 (custom) Affected: 3.3.0 , < 3.3.19 (custom) Affected: 2.7.0 , < 2.7.33 (custom)
Red Hat	HawtIO HawtIO 4.4.0	cpe:/a:redhat:apache_camel_hawtio:4.4::el9
Red Hat	Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14	cpe:/a:redhat:apache_camel_spring_boot:4.18
Red Hat	Red Hat Data Grid 8.6.1	cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat OpenShift Dev Spaces 3.28	Unaffected: 1779528224 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.28::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.28	Unaffected: 1779359423 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.28::el9
Red Hat	Red Hat AMQ Broker 7	cpe:/a:redhat:amq_broker:7
Red Hat	Red Hat AMQ Clients	cpe:/a:redhat:amq_clients:2023
Red Hat	Red Hat build of OptaPlanner 8	cpe:/a:redhat:optaplanner:::el6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform 8	cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Process Automation 7	cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40975",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-28T13:51:27.326869Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-28T14:35:05.760Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_hawtio:4.4::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "HawtIO HawtIO 4.4.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "Red Hat Data Grid 8.6.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779528224",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779359423",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "spring-boot",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "spring-boot",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "log4j:2/log4j",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "log4j",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "spring-boot",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "Red Hat JBoss Enterprise Application Platform 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "spring-boot",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-27T23:32:58.596Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Spring Boot. The `${random.value}` property source utilizes a weak pseudo-random number generator (PRNG), meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information disclosure or a security bypass if they are used in sensitive applications."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-338",
                "description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:00:19.147Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-40975"
          },
          {
            "name": "RHBZ#2463331",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463331"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40975.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25089"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22619"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21772"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17668"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:25089: HawtIO HawtIO 4.4.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22619: Red Hat Data Grid 8.6.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17668: Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-28T00:01:58.716Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-27T23:32:58.596Z",
            "value": "Made public."
          }
        ],
        "title": "Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.",
        "workarounds": [
          {
            "lang": "en",
            "value": "Applications utilizing Spring Boot should avoid using the `${random.value}` property for generating cryptographic secrets or other security-sensitive data. Developers should review their application configurations and code to ensure that only cryptographically strong random number generators are used for such purposes. For UUID generation, `${random.uuid}` is not affected and can be used."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Boot",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.5.14",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.4.16",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.19",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.7.33",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eValues produced by \u003ccode\u003e${random.value}\u003c/code\u003e are not suitable for use as secrets. \u003ccode\u003e${random.uuid}\u003c/code\u003e is not affected. \u003ccode\u003e${random.int}\u003c/code\u003e and \u003ccode\u003e${random.long}\u003c/code\u003e should never be used for secrets as they are numeric values with a predictable range.\u003c/p\u003e\u003cp\u003eAffected: Spring Boot 4.0.0\u20134.0.5 (fix 4.0.6), 3.5.0\u20133.5.13 (fix 3.5.14), 3.4.0\u20133.4.15 (fix 3.4.16), 3.3.0\u20133.3.18 (fix 3.3.19), 2.7.0\u20132.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.\u003c/p\u003e"
            }
          ],
          "value": "Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.\n\nAffected: Spring Boot 4.0.0\u20134.0.5 (fix 4.0.6), 3.5.0\u20133.5.13 (fix 3.5.14), 3.4.0\u20133.4.15 (fix 3.4.16), 3.3.0\u20133.3.18 (fix 3.3.19), 2.7.0\u20132.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Per CVSS v3.1: Confidentiality LOW; Integrity LOW; Availability NONE."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-330",
              "description": "CWE-330: Use of Insufficiently Random Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-27T23:32:58.596Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40975"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40975",
    "datePublished": "2026-04-27T23:32:58.596Z",
    "dateReserved": "2026-04-16T02:19:04.616Z",
    "dateUpdated": "2026-07-15T01:00:19.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40975",
      "date": "2026-08-05",
      "epss": "0.00312",
      "percentile": "0.23592"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40975\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2026-04-28T00:16:24.657\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.\\n\\nAffected: Spring Boot 4.0.0\u20134.0.5 (fix 4.0.6), 3.5.0\u20133.5.13 (fix 3.5.14), 3.4.0\u20133.4.15 (fix 3.4.16), 3.3.0\u20133.3.18 (fix 3.3.19), 2.7.0\u20132.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.\"},{\"lang\":\"es\",\"value\":\"Valores producidos por ${random.value} no son adecuados para su uso como secretos. ${random.uuid} no se ve afectado. ${random.int} y ${random.long} nunca deben usarse para secretos ya que son valores num\u00e9ricos con un rango predecible.\\n\\nAfectado: Spring Boot 4.0.0-4.0.5 (correcci\u00f3n 4.0.6), 3.5.0-3.5.13 (correcci\u00f3n 3.5.14), 3.4.0-3.4.15 (correcci\u00f3n 3.4.16), 3.3.0-3.3.18 (correcci\u00f3n 3.3.19), 2.7.0-2.7.32 (correcci\u00f3n 2.7.33); fuente de propiedades de valor aleatorio / PRNG d\u00e9bil para secretos. Las versiones que ya no son compatibles tambi\u00e9n se ven afectadas seg\u00fan el aviso del proveedor.\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"Spring\",\"product\":\"Spring Boot\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.0.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"lessThan\":\"3.5.14\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.4.0\",\"lessThan\":\"3.4.16\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"3.3.0\",\"lessThan\":\"3.3.19\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"2.7.0\",\"lessThan\":\"2.7.33\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"HawtIO HawtIO 4.4.0\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4.4::el9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8.6.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/openvsx-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1779528224\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/pluginregistry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1779359423\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of OptaPlanner 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:optaplanner:::el6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"log4j:2/log4j\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"log4j\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"spring-boot\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-28T13:51:27.326869Z\",\"id\":\"CVE-2026-40975\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-330\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-338\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.33\",\"matchCriteriaId\":\"5B1C9BD7-7555-4B3D-AED9-60C3C13DCF46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.3.0\",\"versionEndExcluding\":\"3.3.19\",\"matchCriteriaId\":\"28EE6470-24FD-49D1-A2F0-7A19B290A161\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.0\",\"versionEndExcluding\":\"3.4.16\",\"matchCriteriaId\":\"758A9E8F-0C52-43D9-8D84-69622B345A4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.5.0\",\"versionEndExcluding\":\"3.5.14\",\"matchCriteriaId\":\"D23096A1-8269-46C5-9215-9098E87D0A24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndExcluding\":\"4.0.6\",\"matchCriteriaId\":\"12A166C5-8B55-4BA3-AA8B-6024A257D441\"}]}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2026-40975\",\"source\":\"security@vmware.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17668\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21772\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22619\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25089\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-40975\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2463331\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40975.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-30T03:55:20+00:00",
      "cve": "CVE-2026-40975",
      "id": "CVE-2026-40975",
      "initial_release_date": "2026-04-27T23:32:58.596000+00:00",
      "product_status:fixed": "11",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "66",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40975.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Per CVSS v3.1: Confidentiality LOW; Integrity LOW; Availability NONE.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"product\": \"Spring Boot\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"3.5.14\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.4.0\", \"lessThan\": \"3.4.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.3.0\", \"lessThan\": \"3.3.19\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.7.0\", \"lessThan\": \"2.7.33\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://spring.io/security/cve-2026-40975\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.\\n\\nAffected: Spring Boot 4.0.0\\u20134.0.5 (fix 4.0.6), 3.5.0\\u20133.5.13 (fix 3.5.14), 3.4.0\\u20133.4.15 (fix 3.4.16), 3.3.0\\u20133.3.18 (fix 3.3.19), 2.7.0\\u20132.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eValues produced by \u003ccode\u003e${random.value}\u003c/code\u003e are not suitable for use as secrets. \u003ccode\u003e${random.uuid}\u003c/code\u003e is not affected. \u003ccode\u003e${random.int}\u003c/code\u003e and \u003ccode\u003e${random.long}\u003c/code\u003e should never be used for secrets as they are numeric values with a predictable range.\u003c/p\u003e\u003cp\u003eAffected: Spring Boot 4.0.0\\u20134.0.5 (fix 4.0.6), 3.5.0\\u20133.5.13 (fix 3.5.14), 3.4.0\\u20133.4.15 (fix 3.4.16), 3.3.0\\u20133.3.18 (fix 3.3.19), 2.7.0\\u20132.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-330\", \"description\": \"CWE-330: Use of Insufficiently Random Values\"}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2026-04-27T23:32:58.596Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40975\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-28T13:51:27.326869Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-04-28T13:51:35.949Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40975\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-27T23:32:58.596Z\", \"dateReserved\": \"2026-04-16T02:19:04.616Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2026-04-27T23:32:58.596Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

WID-SEC-W-2026-1263

Vulnerability from csaf_certbund - Published: 2026-04-23 22:00 - Updated: 2026-06-10 22:00

Summary

VMware Tanzu Spring Boot: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Spring Boot ist ein Framework zur Entwicklung von Java Anwendungen. Spring Boot basiert auf dem Spring Framework.

Angriff: Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Boot ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Daten zu manipulieren oder offenzulegen oder authentifizierte Benutzer zu kapern.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-40970

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40971

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40972

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40973

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40974

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40975

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40976

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

CVE-2026-40977

Affected products

Known affected 7 products

Product	Identifier	Version
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Apache Camel for Spring Boot Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot`	Apache Camel for Spring Boot
Red Hat OpenShift Dev Spaces <3.28.0 Red Hat / OpenShift		Dev Spaces <3.28.0
VMware Tanzu Spring Boot <3.5.14 VMware Tanzu / Spring Boot		<3.5.14
HCL Commerce 9.1.0-9.1.19.0 HCL / Commerce	`cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0`	9.1.0-9.1.19.0
VMware Tanzu Spring Boot <4.0.6 VMware Tanzu / Spring Boot		<4.0.6

References

18 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://spring.io/blog/2026/04/23/spring-boot-3-5…	external
https://spring.io/blog/2026/04/23/spring-boot-4-0…	external
https://spring.io/security/cve-2026-40970	external
https://spring.io/security/cve-2026-40971	external
https://spring.io/security/cve-2026-40972	external
https://spring.io/security/cve-2026-40973	external
https://spring.io/security/cve-2026-40974	external
https://spring.io/security/cve-2026-40975	external
https://spring.io/security/cve-2026-40976	external
https://spring.io/security/cve-2026-40977	external
https://support.hcl-software.com/community?id=com…	external
https://access.redhat.com/errata/RHSA-2026:17668	external
https://access.redhat.com/errata/RHSA-2026:21772	external
https://access.redhat.com/errata/RHSA-2026:22619	external
https://www.ibm.com/support/pages/node/7275305	external
https://access.redhat.com/errata/RHSA-2026:25089	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Spring Boot ist ein Framework zur Entwicklung von Java Anwendungen. Spring Boot basiert auf dem Spring Framework.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Boot ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Daten zu manipulieren oder offenzulegen oder authentifizierte Benutzer zu kapern.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1263 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1263.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1263 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1263"
      },
      {
        "category": "external",
        "summary": "Spring Blog vom 2026-04-23",
        "url": "https://spring.io/blog/2026/04/23/spring-boot-3-5-14-available-now"
      },
      {
        "category": "external",
        "summary": "Spring Blog vom 2026-04-23",
        "url": "https://spring.io/blog/2026/04/23/spring-boot-4-0-6-available-now"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40970"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40971"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40972"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40973"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40974"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40975"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40976"
      },
      {
        "category": "external",
        "summary": "Spring Security Advisories vom 2026-04-23",
        "url": "https://spring.io/security/cve-2026-40977"
      },
      {
        "category": "external",
        "summary": "HCL Security Bulletin vom 2026-05-12",
        "url": "https://support.hcl-software.com/community?id=community_blog\u0026sys_id=2f600efd2bf4c7900c64f1a1d891bf19"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:17668 vom 2026-05-14",
        "url": "https://access.redhat.com/errata/RHSA-2026:17668"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:21772 vom 2026-05-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:21772"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:22619 vom 2026-06-02",
        "url": "https://access.redhat.com/errata/RHSA-2026:22619"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7275305 vom 2026-06-06",
        "url": "https://www.ibm.com/support/pages/node/7275305"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:25089 vom 2026-06-10",
        "url": "https://access.redhat.com/errata/RHSA-2026:25089"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Boot: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-10T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-11T10:26:04.306+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1263",
      "initial_release_date": "2026-04-23T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-04-23T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-04-27T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-25908, EUVD-2026-25936, EUVD-2026-25930, EUVD-2026-25941, EUVD-2026-25940, EUVD-2026-25939, EUVD-2026-25938, EUVD-2026-25937"
        },
        {
          "date": "2026-05-12T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2026-05-14T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-05-28T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-02T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-07T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-06-10T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "8"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "9.1.0-9.1.19.0",
                "product": {
                  "name": "HCL Commerce 9.1.0-9.1.19.0",
                  "product_id": "T053858",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hcltechsw:commerce:9.1.0_-_9.1.19.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Commerce"
          }
        ],
        "category": "vendor",
        "name": "HCL"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Sterling Connect:Direct",
            "product": {
              "name": "IBM Sterling Connect:Direct",
              "product_id": "T045428",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:sterling_connect%3adirect:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Apache Camel for Spring Boot",
                "product": {
                  "name": "Red Hat Enterprise Linux Apache Camel for Spring Boot",
                  "product_id": "T040879",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:apache_camel_for_spring_boot"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Dev Spaces \u003c3.28.0",
                "product": {
                  "name": "Red Hat OpenShift Dev Spaces \u003c3.28.0",
                  "product_id": "T054838"
                }
              },
              {
                "category": "product_version",
                "name": "Dev Spaces 3.28.0",
                "product": {
                  "name": "Red Hat OpenShift Dev Spaces 3.28.0",
                  "product_id": "T054838-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:dev_spaces__3.28.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.5.14",
                "product": {
                  "name": "VMware Tanzu Spring Boot \u003c3.5.14",
                  "product_id": "T053307"
                }
              },
              {
                "category": "product_version",
                "name": "3.5.14",
                "product": {
                  "name": "VMware Tanzu Spring Boot 3.5.14",
                  "product_id": "T053307-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_boot:3.5.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c4.0.6",
                "product": {
                  "name": "VMware Tanzu Spring Boot \u003c4.0.6",
                  "product_id": "T053308"
                }
              },
              {
                "category": "product_version",
                "name": "4.0.6",
                "product": {
                  "name": "VMware Tanzu Spring Boot 4.0.6",
                  "product_id": "T053308-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_boot:4.0.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Boot"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-40970",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40970"
    },
    {
      "cve": "CVE-2026-40971",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40971"
    },
    {
      "cve": "CVE-2026-40972",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40972"
    },
    {
      "cve": "CVE-2026-40973",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40973"
    },
    {
      "cve": "CVE-2026-40974",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40974"
    },
    {
      "cve": "CVE-2026-40975",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40975"
    },
    {
      "cve": "CVE-2026-40976",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40976"
    },
    {
      "cve": "CVE-2026-40977",
      "product_status": {
        "known_affected": [
          "T045428",
          "67646",
          "T040879",
          "T054838",
          "T053307",
          "T053858",
          "T053308"
        ]
      },
      "release_date": "2026-04-23T22:00:00.000+00:00",
      "title": "CVE-2026-40977"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-40975 (GCVE-0-2026-40975)

WID-SEC-W-2026-1263

Tags

Sightings

Nomenclature