Spring Boot: Spring Boot: Information disclosure and data tampering via missing hostname verification
Published Apr 27, 2026
9.1
CRITICALCVSS 3.1
EPSS 0.30%
Description
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.
Affected products
-
- Version 3.5.0StatusaffectedConstraints<3.5.14
- Version 4.0.0StatusaffectedConstraints<4.0.6
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Spring | Spring Boot | unaffected |
|
- ≥ 3.5.0 · < 3.5.14
- ≥ 4.0.0 · < 4.0.6
No data.
Red Hat AMQ Broker 7
spring-boot
Fix deferred
Red Hat AMQ Clients
spring-boot
Fix deferred
Red Hat Data Grid 8
spring-boot
Fix deferred
Red Hat Enterprise Linux 8
log4j:2/log4j
Fix deferred
Red Hat Enterprise Linux 9
log4j
Out of support scope
Red Hat Fuse 7
spring-boot
Fix deferred
Red Hat JBoss Enterprise Application Platform 7
spring-boot
Fix deferred
Red Hat JBoss Enterprise Application Platform 8
spring-boot
Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack
spring-boot
Fix deferred
Red Hat OpenShift Dev Spaces
devspaces/openvsx-rhel9
Fix deferred
Red Hat OpenShift Dev Spaces
devspaces/pluginregistry-rhel9
Fix deferred
Red Hat Process Automation 7
spring-boot
Fix deferred
Red Hat Single Sign-On 7
spring-boot
Fix deferred
Red Hat build of Apache Camel - HawtIO 4
spring-boot
Fix deferred
Red Hat build of Apache Camel for Spring Boot 4
spring-boot
Fix deferred
Red Hat build of OptaPlanner 8
spring-boot
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat AMQ Broker 7 | spring-boot | Fix deferred | n/a |
| Red Hat AMQ Clients | spring-boot | Fix deferred | n/a |
| Red Hat Data Grid 8 | spring-boot | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | log4j:2/log4j | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | log4j | Out of support scope | n/a |
| Red Hat Fuse 7 | spring-boot | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform 7 | spring-boot | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform 8 | spring-boot | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | spring-boot | Fix deferred | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/openvsx-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Dev Spaces | devspaces/pluginregistry-rhel9 | Fix deferred | n/a |
| Red Hat Process Automation 7 | spring-boot | Fix deferred | n/a |
| Red Hat Single Sign-On 7 | spring-boot | Fix deferred | n/a |
| Red Hat build of Apache Camel - HawtIO 4 | spring-boot | Fix deferred | n/a |
| Red Hat build of Apache Camel for Spring Boot 4 | spring-boot | Fix deferred | n/a |
| Red Hat build of OptaPlanner 8 | spring-boot | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References (6)
- https://access.redhat.com/security/cve/CVE-2026-40971 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2463313 Issue Tracking
- https://github.com/advisories/GHSA-9vc8-qppq-wvxc Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-40971
- https://spring.io/security/cve-2026-40971 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-40971
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-40971 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2463313 | Issue Tracking | |
| https://github.com/advisories/GHSA-9vc8-qppq-wvxc | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-40971 | ||
| https://spring.io/security/cve-2026-40971 | Vendor Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2026-40971 |
Change history (0)
No recorded changes yet.