CVE-2026-40972
Vmware Spring Boot ≤ 2.7.33
Raw vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-40972 is a high-severity Observable Timing Discrepancy (CWE-208) vulnerability in Vmware Spring Boot. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Guessing (T1110.001); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40972 is a timing side-channel vulnerability (CWE-208) in the remote secret comparison mechanism of Spring Boot DevTools. It affects Spring Boot versions 4.0.0 through 4.0.5 (fixed in 4.0.6), 3.5.0 through 3.5.13 (fixed in 3.5.14), 3.4.0 through 3.4.15 (fixed in 3.4.16), 3.3.0 through 3.3.18 (fixed in 3.3.19), and 2.7.0 through 2.7.32 (fixed in 2.7.33). Versions no longer supported are also vulnerable according to the vendor advisory. The issue has a CVSS v3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
An adjacent attacker on the same network as the vulnerable Spring Boot application can exploit this through a timing attack to leak information about the DevTools remote secret. In extreme cases, successful exploitation allows the attacker to fully recover the secret, enabling them to upload modified classes to the target application and achieve remote code execution.
The Spring security advisory at https://spring.io/security/cve-2026-40972 recommends upgrading to the fixed versions listed above. Unsupported versions remain vulnerable with no patches available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25936
Vulnerability Data
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed…
more
classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.2.4
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can include timing analysis or side-channel test cases that reveal observable timing discrepancies.
Engineering principles can mandate constant-time algorithms and side-channel resistance so timing discrepancies are never introduced.
Requiring approved cryptographic modules and algorithms implicitly demands implementations free of observable timing leaks.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.