This vulnerability (CVE-2026-40975) in Spring Boot arises from the use of weak pseudo-random number generation for secrets via the ${random.value} property source. The values produced are insufficiently random and thus unsuitable for cryptographic secrets. While ${random.uuid} is not affected, numeric random values such as ${random.int} and ${random.long} should never be used for secrets due to their predictable numeric ranges. The issue affects multiple Spring Boot versions from 2.7.0 up to 4.0.5, with fixes released in subsequent patch versions. Red Hat advisories confirm the vulnerability and provide updates for affected products. The CVSS 3.1 base score is 4.8, indicating medium severity with low confidentiality and integrity impact and no availability impact. No known exploits in the wild have been reported. The vendor has released fixed versions addressing this weakness.

The vulnerability allows the generation of secrets using insufficiently random values, which can lead to information disclosure or compromise of secret-based security mechanisms. The impact is limited to confidentiality and integrity with low severity, as indicated by the CVSS score of 4.8. There is no impact on availability. Exploitation could potentially allow attackers to predict or guess secrets generated by the affected random value property source, weakening security controls that rely on these secrets.

Fixed versions of Spring Boot are available and should be applied: 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6 or later. Users should avoid using ${random.value}, ${random.int}, and ${random.long} for generating secrets and instead use ${random.uuid} or other cryptographically secure random generators. Refer to the Red Hat advisories for detailed patch information and update instructions. Patch status is confirmed by vendor advisories. No additional mitigation is required beyond applying the official fixes and avoiding insecure random value usage for secrets.