CVE-2026-40971

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-40971
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://spring.io/security/cve-2026-40971 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
History

14 May 2026, 16:06

Type Values Removed Values Added
References () https://spring.io/security/cve-2026-40971 - () https://spring.io/security/cve-2026-40971 - Vendor Advisory
CPE cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
First Time Vmware
Vmware spring Boot

27 Apr 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-27 23:16

Updated : 2026-05-14 16:06

NVD link : CVE-2026-40971

Mitre link : CVE-2026-40971

CVE.ORG link : CVE-2026-40971

JSON object : View

Products Affected

vmware

  • spring_boot
CWE
CWE-295

Improper Certificate Validation