Vmware Spring Boot up to 4.0.5 DevTools timing discrepancy

Summaryinfo

A vulnerability was found in Vmware Spring Boot up to 2.7.32/3.3.18/3.4.15/3.5.13/4.0.5. It has been classified as problematic. This affects an unknown part of the component DevTools. Performing a manipulation results in timing discrepancy. This vulnerability is cataloged as CVE-2026-40972. The attack must originate from the local network. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Vmware Spring Boot up to 2.7.32/3.3.18/3.4.15/3.5.13/4.0.5. It has been classified as problematic. This affects an unknown code block of the component DevTools. The manipulation with an unknown input leads to a timing discrepancy vulnerability. CWE is classifying the issue as CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality. The summary by CVE is:

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

The advisory is shared at spring.io. This vulnerability is uniquely identified as CVE-2026-40972 since 04/16/2026. The exploitability is told to be difficult. Access to the local network is required for this attack. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/03/2026). MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 2.7.33, 3.3.19, 3.4.16, 3.5.14 or 4.0.6 eliminates this vulnerability.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202604-5563) and CERT Bund (WID-SEC-2026-1263). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Red Hat Enterprise Linux
• VMware Tanzu Spring Boot
• HCL Commerce
• Red Hat OpenShift

Productinfo

Vendor

• Vmware

Name

• Spring Boot

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 2.7.4
• 2.7.5
• 2.7.6
• 2.7.7
• 2.7.8
• 2.7.9
• 2.7.10
• 2.7.11
• 2.7.12
• 2.7.13
• 2.7.14
• 2.7.15
• 2.7.16
• 2.7.17
• 2.7.18
• 2.7.19
• 2.7.20
• 2.7.21
• 2.7.22
• 2.7.23
• 2.7.24
• 2.7.25
• 2.7.26
• 2.7.27
• 2.7.28
• 2.7.29
• 2.7.30
• 2.7.31
• 2.7.32
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7
• 3.3.8
• 3.3.9
• 3.3.10
• 3.3.11
• 3.3.12
• 3.3.13
• 3.3.14
• 3.3.15
• 3.3.16
• 3.3.17
• 3.3.18
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 3.4.11
• 3.4.12
• 3.4.13
• 3.4.14
• 3.4.15
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.5.10
• 3.5.11
• 3.5.12
• 3.5.13
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion