SB
Product
Spring Boot
20
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 8Medium 6Low 0
Watch
Add Spring Boot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40970 | 6.8 | Apr 27 | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server Affected: 4.0.0 before 4.0.6 |
| CVE-2026-40977 | 6.7 | Apr 27 | When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the… Affected: before 2.7.33; 3.3.0 before 3.3.19; 3.4.0 before 3.4.16; 3.5.0 before 3.5.14; 4.0.0 before 4.0.6 |
| CVE-2023-34055 | 6.5 | Nov 28 | In Spring Boot versions 2.7.0 - 2.7.17, 3.0.0-3.0.12 and 3.1.0-3.1.5, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)… Affected: 2.7.0 through 2.7.17; 3.0.0 through 3.0.12; 3.1.0 through 3.1.5 |
| CVE-2018-1196 | 5.9 | Mar 19 | Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service Affected: through 1.5.9; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +2 more |
| CVE-2026-41001 | 5.3 | Jun 11 | Predictable Temp Directory in Artemis Auto-configuration Affected: before 2.7.34; 3.3.0 before 3.3.20; 3.4.0 before 3.4.17; 3.5.0 before 3.5.14.1; 4.0.0 before 4.0.6.1 |
| CVE-2026-40992 | 5.0 | Jun 11 | Mail Auto-Configuration Does Not Enable SSL Hostname Verification Affected: 3.4.0 before 3.4.17; 3.5.0 before 3.5.14.1; 4.0.0 before 4.0.6.1 |
Showing 6