Spring Boot CVE-2026-40973

Exploitation requires the Spring Boot application to have server.servlet.session.persistent set to true in configuration (non-default setting). Attacker must have a local user account on the same host as the Spring Boot application (low-privilege access sufficient). Attack persistence across at least one application restart is required for session hijacking or gadget chain deployment. The attacker must win a race condition or exploit predictable directory naming to take control of the ApplicationTemp directory before the application claims it. High attack complexity (AC:H) indicates timing dependencies or specific system states must align, such as application restart windows, filesystem permissions allowing directory creation in the temp path, or absence of operating system-level protections preventing directory substitution attacks. The vulnerability is limited to local attack scenarios and does not enable remote exploitation without pre-existing local access through other means.

Real-world risk is moderate despite the 7.0 CVSS score due to multiple limiting factors. Attack vector is local (AV:L) requiring existing host access, high complexity (AC:H) suggesting exploitation requires precise timing or race condition wins, and low privileges (PR:L) meaning the attacker needs at least basic user account access on the same host. The critical dependency on server.servlet.session.persistent being set to true significantly reduces the attack surface, as this is not a default Spring Boot configuration and is typically only enabled in specific deployment scenarios requiring session persistence across restarts. No EPSS score is provided in the data, preventing statistical exploitation probability assessment. No CISA KEV listing indicates no confirmed active exploitation. No public exploit identified at time of analysis. The technical impact is severe (C:H/I:H/A:H) if conditions are met, enabling full session hijacking or code execution as the application user. Primary risk exists in multi-tenant environments, shared hosting platforms, or containerized deployments where multiple users have local access to the same host running Spring Boot applications with persistent sessions enabled. Organizations using default configurations or running Spring Boot in isolated single-tenant environments face substantially lower risk. The availability of vendor patches across all supported branches enables effective mitigation for current deployments.

An attacker with a low-privilege local account on a shared application server running Spring Boot 3.5.12 with persistent sessions enabled predicts or races to create the ApplicationTemp directory before the application starts. The attacker maintains control of this directory across an application restart or maintenance window. When the Spring Boot application resumes and writes serialized session data to the attacker-controlled directory, the attacker reads session files to extract authentication tokens and JSESSIONID values, hijacking active user sessions. Alternatively, the attacker plants a malicious serialized Java object containing a gadget chain in the directory. When the application reads and deserializes this object during session restoration, the gadget chain executes arbitrary code with the privileges of the application user, potentially leading to further system compromise.