← Back

CVE-2026-40974

nvd nist
Published: Apr 28, 2026Modified: Jul 24, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.

Affected (5)

Products: Vmware: Spring Boot
Vmware
1 product
Spring Boot
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Boot
From 2.7.0 to 2.7.33
Spring Boot
From 3.3.0 to 3.3.19
Spring Boot
From 3.4.0 to 3.4.16
Spring Boot
From 3.5.0 to 3.5.14
Spring Boot
From 4.0.0 to 4.0.6

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.