PT-2026-48616 · Vmware · Spring Boot
CVE-2026-40992
·
Published
2026-06-11
·
Updated
2026-07-02
CVSS v3.1
5.0
Medium
| Vector | AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Spring Boot versions 4.0.0 through 4.0.6
Spring Boot versions 3.5.0 through 3.5.14
Spring Boot versions 3.4.0 through 3.4.16
Description
Mail auto-configuration does not enable hostname verification, which is the process of verifying that the server's certificate matches its actual hostname to prevent man-in-the-middle attacks.
Recommendations
For versions 4.0.0 through 4.0.6, 3.5.0 through 3.5.14, and 3.4.0 through 3.4.16, set the JavaMail property
spring.mail.properties.mail.smtp.ssl.checkserveridentity to true.Exploit
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Spring Boot