What is the CVSS score of CVE-2026-40971?

CVE-2026-40971 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-40971?

Yes, a patch is available for CVE-2026-40971. Update the affected software to the latest version immediately.

Spring Boot CVE-2026-40971

CRITICAL

Improper Certificate Validation (CWE-295)

2026-04-27 vmware

Information Disclosure Java Spring Boot

Critical

Disputed · 9.1 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.0 MEDIUM

Adjacent vector and high complexity reflect mandatory network interception positioning; all impacts are Low as attacker reaches only the RabbitMQ channel, not the host itself.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Red Hat

4.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 21:22 NVD

MEDIUM CRITICAL

CVSS changed

Jul 24, 2026 - 21:22 NVD

5.0 (MEDIUM) 9.1 (CRITICAL)

Analysis Generated

Jul 24, 2026 - 04:26 vuln.today

CVE Published

Apr 27, 2026 - 22:45 nvd

MEDIUM 5.0

DescriptionNVD

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.

Affected: Spring Boot 4.0.0-4.0.5 (fix 4.0.6), 3.5.0-3.5.13 (fix 3.5.14) per vendor advisory.

AnalysisAI

Spring Boot's RabbitMQ auto-configuration omits TLS hostname verification when an SSL bundle is configured, enabling a man-in-the-middle attack on the message broker connection. Affected are Spring Boot 4.0.0-4.0.5 and 3.5.0-3.5.13; fixed in 4.0.6 and 3.5.14 respectively per the vendor advisory at spring.io. No active exploitation has been confirmed - CISA KEV status is absent, EPSS is 0.01% (3rd percentile), and SSVC classifies exploitation as none - making this a medium-priority patch for deployments that use SSL bundles with RabbitMQ.

Technical ContextAI

CWE-295 (Improper Certificate Validation) describes cases where TLS is established but the certificate's Subject Alternative Names or Common Name are never matched against the intended server hostname, leaving the channel open to impersonation. Spring Boot's auto-configuration for RabbitMQ (cpe:2.3:a:spring:spring_boot) wires connection-factory beans automatically when spring.rabbitmq.* properties are present. When the SSL bundle mechanism - a Spring Boot 3.1+ feature that centralises keystore/truststore configuration - is used, the auto-configured connection factory does not set a hostname verifier, bypassing a control that is normally enforced by default in standard Java TLS. The flaw is scoped to the auto-configuration path; manually constructed connection factories are not affected unless they replicate the same omission.

RemediationAI

The primary fix is to upgrade to Spring Boot 4.0.6 (for 4.0.x users) or 3.5.14 (for 3.5.x users), as confirmed by the vendor advisory at https://spring.io/security/cve-2026-40971. If an immediate upgrade is not feasible, operators can mitigate by moving to a manually configured RabbitMQ connection factory that explicitly sets a hostname verifier - this bypasses the flawed auto-configuration path but requires code changes and re-testing. A network-level compensating control is to enforce strict network segmentation so that no untrusted host can reach the path between the Spring Boot application and its RabbitMQ broker; this limits the adjacent-network exploitation window but does not eliminate the underlying flaw. Disabling SSL bundles in favour of direct truststore configuration is another workaround, though this loses the ergonomic benefits of the bundle mechanism. No version-number outside of 4.0.6 and 3.5.14 should be inferred as patched.