This vulnerability (CVE-2026-40972) involves an observable timing discrepancy in the DevTools remote secret comparison mechanism of Spring Boot. An attacker on the same network segment as the target application can perform a timing attack to glean information about the secret used to authenticate remote class uploads. If the secret is fully determined, the attacker could upload altered classes, resulting in remote code execution on the affected Spring Boot application. The issue affects multiple versions of Spring Boot from 2.7.0 up to 4.0.5, with fixed versions released starting at 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6. The vulnerability is classified under CWE-208 (Observable Timing Discrepancy) and carries a CVSS v3.1 score of 7.5, indicating high severity. The vendor advisory or patch links were not provided, so patch availability is not explicitly confirmed.

Successful exploitation allows an attacker on the same network to perform a timing attack to discover the remote secret used by Spring Boot DevTools. This can lead to the attacker determining the secret and uploading malicious classes to the application, resulting in remote code execution. This compromises confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported as of the published date.

The provided data lists fixed versions for the affected Spring Boot releases: 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6. Users should upgrade to these or later versions to remediate the vulnerability. Since no vendor advisory or explicit patch status is included, confirm patch availability and upgrade guidance from the official Spring project resources before applying updates. No other mitigation details are provided.