CVE-2026-40992

MEDIUM EPSS 2.5%

Published Jun 11, 20263w ago · Modified Jun 23, 20261w ago

5.0 CVSS 3.1

Medium

Published Jun 11, 2026 3w ago

Last Modified Jun 23, 2026 1w ago

Description

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.

CVSS Details

Base Score

5.0

Exploitability

1.6

Impact

3.4

Vector string

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector Adjacent

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability Low

Threat Intelligence

EPSS Exploit Probability

2.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-295

References 1

spring.io https://spring.io/security/cve-2026-40992

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.