CVE-2026-40975 Spring Boot弱随机数生成漏洞

import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.context.annotation.Bean; import org.springframework.core.env.Environment; @SpringBootApplication public class VulnerableApp { public static void main(String[] args) { // Start the application with a vulnerable Spring Boot version SpringApplication.run(VulnerableApp.class, args); } @Bean public String demonstrateWeakRandom(Environment env) { // In vulnerable versions, this uses java.util.Random which is predictable String weakSecret = env.getProperty("random.value"); // Attackers can predict this value if they know the startup time System.out.println("Predictable Secret: " + weakSecret); return weakSecret; } }