Information Exposure Through Timing Discrepancy in spring-boot - CVE-2026-40972
Published: April 27, 2026
Vulnerability identifier: #VU128231
CSH Severity: Medium
CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40972
CWE-ID: CWE-208
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to observable timing discrepancies in DevTools remote secret comparison when validating the remote secret over an adjacent network. A remote attacker can measure response timing to discover the secret and execute arbitrary code.
Exploitation is limited to attackers on the same network as the remote application, and successful secret recovery may allow uploading changed classes.
Affected software
spring-boot
Db2 Developer Extension
Library Support for Spring
Db2 Developer Extension
Library Support for Spring
How to mitigate CVE-2026-40972
Install security update from vendor's website.
spring-boot - addressed in versions 2.7.33, 3.3.19, 3.4.16, 3.5.14, 4.0.6
Db2 Developer Extension - update to 1.1.2
Library Support for Spring - update to 3.4.18
Db2 Developer Extension - update to 1.1.2
Library Support for Spring - update to 3.4.18