What is the CVSS score of CVE-2026-40974?

CVE-2026-40974 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40974?

Yes, a patch is available for CVE-2026-40974. Update the affected software to the latest version immediately.

Spring Boot CVE-2026-40974

MEDIUM

Improper Certificate Validation (CWE-295)

2026-04-28 security@vmware.com

Information Disclosure Java

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Red Hat

6.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 00:30 vuln.today

Analysis Generated

Apr 28, 2026 - 00:22 vuln.today

CVE Published

Apr 28, 2026 - 00:16 nvd

MEDIUM 5.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

16 maven packages depend on org.springframework.boot:spring-boot-cassandra (5 direct, 11 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.

Affected: Spring Boot 4.0.0-4.0.5 (fix 4.0.6), 3.5.0-3.5.13 (fix 3.5.14), 3.4.0-3.4.15 (fix 3.4.16), 3.3.0-3.3.18 (fix 3.3.19), 2.7.0-2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.

AnalysisAI

Spring Boot's Cassandra auto-configuration fails to verify hostnames during SSL/TLS connection establishment to Cassandra servers, enabling man-in-the-middle attackers on the local network to intercept credentials and data by presenting a valid certificate for any domain. Affects Spring Boot 2.7.0-4.0.5; vendor-released patches available for all supported versions (4.0.6, 3.5.14, 3.4.16, 3.3.19, 2.7.33). No public exploit code identified at time of analysis.

Technical ContextAI

Spring Boot provides auto-configuration for Cassandra database connections, including SSL/TLS setup. The vulnerability resides in the Cassandra auto-configuration module's SSL context initialization, which accepts valid SSL certificates but does not enforce hostname verification-a critical validation step that ensures the certificate's Subject Alternative Name (SAN) or Common Name (CN) matches the target hostname. This is a violation of CWE-295 (Improper Certificate Validation) and allows attackers positioned on the network path (e.g., corporate LAN, compromised router, or shared cloud infrastructure) to substitute a legitimate CA-signed certificate for any hostname and successfully complete the TLS handshake. The affected versions span Spring Boot 2.7.x through 4.0.x release lines, impacting both active and unsupported versions per vendor guidance.

RemediationAI

Upgrade Spring Boot immediately to the patched versions: 2.7.33, 3.3.19, 3.4.16, 3.5.14, or 4.0.6 or later, depending on your current branch. These releases enable hostname verification by default in the Cassandra SSL auto-configuration. For organizations unable to upgrade immediately, disable Cassandra SSL/TLS auto-configuration and manually configure the Cassandra driver with explicit hostname verification enabled (e.g., via the Cassandra Java driver's SSLContext with proper HostnameVerifier implementation). This workaround requires custom Spring configuration and should be validated with your Cassandra operations team to ensure compatibility. Alternatively, restrict network access to Cassandra servers using firewall rules and network segmentation to limit the attack surface to trusted, authenticated network segments; this does not fix the underlying vulnerability but reduces the likelihood of successful man-in-the-middle attacks in locked-down environments. All mitigations should be tested in a staging environment before production deployment. Full advisory and patch details: https://spring.io/security/cve-2026-40974.