Vulnerability Details CVE-2026-40970
When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 8.8%
CVSS Severity
CVSS v3 Score 5.0
References
Products affected by CVE-2026-40970
-
cpe:2.3:a:vmware:spring_boot:4.0.0
-
cpe:2.3:a:vmware:spring_boot:4.0.1
-
cpe:2.3:a:vmware:spring_boot:4.0.2
-
cpe:2.3:a:vmware:spring_boot:4.0.3
-
cpe:2.3:a:vmware:spring_boot:4.0.4
-
cpe:2.3:a:vmware:spring_boot:4.0.5