PT-2026-35515

CVE-2026-40970

Published

2026-04-27

Updated

2026-05-17

Description by

CVSS 3.1

6.8

Medium

MetricsAV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5

Description When configured to use an SSL bundle, the Elasticsearch auto-configuration fails to perform hostname verification during the connection to the Elasticsearch server. Hostname verification is a security process that ensures the server's certificate matches its actual hostname to prevent man-in-the-middle attacks.

Recommendations Upgrade to version 4.0.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

August829

Yu Bao

Vendors

Affected products

Weakness enumeration

CWE-295: Improper Certificate Validation