CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40992

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 2.4%

CVSS Severity

CVSS v3 Score 5.0

References

https://spring.io/security/cve-2026-40992

Products affected by CVE-2026-40992

Vmware » Spring Boot » Version: 3.4.0

cpe:2.3:a:vmware:spring_boot:3.4.0
Vmware » Spring Boot » Version: 3.4.1

cpe:2.3:a:vmware:spring_boot:3.4.1
Vmware » Spring Boot » Version: 3.4.10

cpe:2.3:a:vmware:spring_boot:3.4.10
Vmware » Spring Boot » Version: 3.4.11

cpe:2.3:a:vmware:spring_boot:3.4.11
Vmware » Spring Boot » Version: 3.4.12

cpe:2.3:a:vmware:spring_boot:3.4.12
Vmware » Spring Boot » Version: 3.4.13

cpe:2.3:a:vmware:spring_boot:3.4.13
Vmware » Spring Boot » Version: 3.4.14

cpe:2.3:a:vmware:spring_boot:3.4.14
Vmware » Spring Boot » Version: 3.4.15

cpe:2.3:a:vmware:spring_boot:3.4.15
Vmware » Spring Boot » Version: 3.4.15.1

cpe:2.3:a:vmware:spring_boot:3.4.15.1
Vmware » Spring Boot » Version: 3.4.15.2

cpe:2.3:a:vmware:spring_boot:3.4.15.2
Vmware » Spring Boot » Version: 3.4.16

cpe:2.3:a:vmware:spring_boot:3.4.16
Vmware » Spring Boot » Version: 3.4.2

cpe:2.3:a:vmware:spring_boot:3.4.2
Vmware » Spring Boot » Version: 3.4.3

cpe:2.3:a:vmware:spring_boot:3.4.3
Vmware » Spring Boot » Version: 3.4.4

cpe:2.3:a:vmware:spring_boot:3.4.4
Vmware » Spring Boot » Version: 3.4.5

cpe:2.3:a:vmware:spring_boot:3.4.5
Vmware » Spring Boot » Version: 3.4.6

cpe:2.3:a:vmware:spring_boot:3.4.6
Vmware » Spring Boot » Version: 3.4.7

cpe:2.3:a:vmware:spring_boot:3.4.7
Vmware » Spring Boot » Version: 3.4.8

cpe:2.3:a:vmware:spring_boot:3.4.8
Vmware » Spring Boot » Version: 3.4.9

cpe:2.3:a:vmware:spring_boot:3.4.9
Vmware » Spring Boot » Version: 3.5.0

cpe:2.3:a:vmware:spring_boot:3.5.0
Vmware » Spring Boot » Version: 3.5.1

cpe:2.3:a:vmware:spring_boot:3.5.1
Vmware » Spring Boot » Version: 3.5.10

cpe:2.3:a:vmware:spring_boot:3.5.10
Vmware » Spring Boot » Version: 3.5.11

cpe:2.3:a:vmware:spring_boot:3.5.11
Vmware » Spring Boot » Version: 3.5.12

cpe:2.3:a:vmware:spring_boot:3.5.12
Vmware » Spring Boot » Version: 3.5.13

cpe:2.3:a:vmware:spring_boot:3.5.13
Vmware » Spring Boot » Version: 3.5.14

cpe:2.3:a:vmware:spring_boot:3.5.14
Vmware » Spring Boot » Version: 3.5.2

cpe:2.3:a:vmware:spring_boot:3.5.2
Vmware » Spring Boot » Version: 3.5.3

cpe:2.3:a:vmware:spring_boot:3.5.3
Vmware » Spring Boot » Version: 3.5.4

cpe:2.3:a:vmware:spring_boot:3.5.4
Vmware » Spring Boot » Version: 3.5.5

cpe:2.3:a:vmware:spring_boot:3.5.5
Vmware » Spring Boot » Version: 3.5.6

cpe:2.3:a:vmware:spring_boot:3.5.6
Vmware » Spring Boot » Version: 3.5.7

cpe:2.3:a:vmware:spring_boot:3.5.7
Vmware » Spring Boot » Version: 3.5.8

cpe:2.3:a:vmware:spring_boot:3.5.8
Vmware » Spring Boot » Version: 3.5.9

cpe:2.3:a:vmware:spring_boot:3.5.9
Vmware » Spring Boot » Version: 4.0.0

cpe:2.3:a:vmware:spring_boot:4.0.0
Vmware » Spring Boot » Version: 4.0.1

cpe:2.3:a:vmware:spring_boot:4.0.1
Vmware » Spring Boot » Version: 4.0.2

cpe:2.3:a:vmware:spring_boot:4.0.2
Vmware » Spring Boot » Version: 4.0.3

cpe:2.3:a:vmware:spring_boot:4.0.3
Vmware » Spring Boot » Version: 4.0.4

cpe:2.3:a:vmware:spring_boot:4.0.4
Vmware » Spring Boot » Version: 4.0.5

cpe:2.3:a:vmware:spring_boot:4.0.5
Vmware » Spring Boot » Version: 4.0.6

cpe:2.3:a:vmware:spring_boot:4.0.6

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40992

Products

Pricing

Contact Us