Vmware Spring Boot up to 3.4.16/3.5.14/4.0.6 Configuration certificate validation

Summaryinfo

A vulnerability was found in Vmware Spring Boot up to 3.4.16/3.5.14/4.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Configuration Handler. Executing a manipulation can lead to certificate validation. This vulnerability appears as CVE-2026-40992. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Vmware Spring Boot up to 3.4.16/3.5.14/4.0.6. It has been declared as problematic. This vulnerability affects some unknown processing of the component Configuration Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. CVE summarizes:

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.

The advisory is shared for download at spring.io. This vulnerability was named CVE-2026-40992 since 04/16/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/15/2026). The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading to version 3.4.17, 3.5.15 or 4.0.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202606-3065). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Vmware

Name

• Spring Boot

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.4.7
• 3.4.8
• 3.4.9
• 3.4.10
• 3.4.11
• 3.4.12
• 3.4.13
• 3.4.14
• 3.4.15
• 3.4.16
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.5.10
• 3.5.11
• 3.5.12
• 3.5.13
• 3.5.14
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion