CVE-2026-40992 Security Details

CVE ID

CVE-2026-40992

CWE

CWE-295

CVE Description

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.

Published

Jun 11, 2026

CVSS Score & Severity

2.3Low

CVSS Vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS Score

0.123%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/boot/autoconfigure/mail/MailSenderPropertiesConfiguration.applyProperties(Lorg/springframework/boot/autoconfigure/mail/MailProperties;Lorg/springframework/mail/javamail/JavaMailSenderImpl;Lorg/springframework/boot/ssl/SslBundles;)V

JVM

org/springframework/boot/mail/autoconfigure/MailSenderPropertiesConfiguration.applyProperties(Lorg/springframework/boot/mail/autoconfigure/MailProperties;Lorg/springframework/mail/javamail/JavaMailSenderImpl;Lorg/springframework/boot/ssl/SslBundles;)V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT