What’s Vulnerable › Products

Spring Boot vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your Spring Boot version is affected

Latest Spring Boot vulnerabilities

• CVE-2026-41001 — Predictable Temp Directory in Artemis Auto-configuration (CVSS 5.3)
• CVE-2026-40992 — Mail Auto-Configuration Does Not Enable SSL Hostname Verification (CVSS 5.0)
• CVE-2026-40977 — (CVSS 6.7)
• CVE-2026-40976 — (CVSS 9.1)
• CVE-2026-40975 — (CVSS 7.5)
• CVE-2026-40974 — (CVSS 9.8)
• CVE-2026-40973 — (CVSS 7.0)
• CVE-2026-40972 — (CVSS 7.5)
• CVE-2026-40971 — (CVSS 9.1)
• CVE-2026-40970 — (CVSS 6.8)
• CVE-2026-22733 — Authentication Bypass under Actuator CloudFoundry endpoints (CVSS 8.1)
• CVE-2026-22731 — Authentication Bypass under Actuator Health groups paths (CVSS 8.1)
• CVE-2025-22235 — Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed (CVSS 7.3)
• CVE-2024-38807 — CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader (CVSS 6.3)
• CVE-2023-34055 — Spring Boot server Web Observations DoS Vulnerability (CVSS 6.5)
• CVE-2023-20883 — (CVSS 7.5)
• CVE-2023-20873 — (CVSS 9.8)
• CVE-2023-22602 — Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request (CVSS 7.5)
• CVE-2022-27772 — (CVSS 7.8)
• CVE-2021-26987 — (CVSS 9.8)
• CVE-2018-1196 — (CVSS 5.9)
• CVE-2017-8046 — (CVSS 9.8)