This vulnerability involves the use of weak pseudorandom number generators in Spring Boot's random value property source. Specifically, the values produced by ${random.value}, ${random.int}, and ${random.long} are insufficiently random and thus unsuitable for generating secrets, potentially compromising confidentiality. The ${random.uuid} generator remains secure. Affected versions include Spring Boot 2.7.0 to 2.7.32, 3.3.0 to 3.3.18, 3.4.0 to 3.4.15, 3.5.0 to 3.5.13, and 4.0.0 to 4.0.5. Vendor advisories indicate fixes were introduced in versions 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6. The CVSS v3.1 base score is 4.8, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impacts.

The vulnerability can lead to the generation of predictable secret values when using certain random generators in Spring Boot, potentially allowing attackers to guess or reproduce secrets. This may result in limited confidentiality and integrity impacts. There are no reported exploits in the wild, and the attack complexity is high, reducing immediate risk. The vulnerability does not affect availability.

Upgrading to the fixed versions of Spring Boot is recommended: 2.7.33, 3.3.19, 3.4.16, 3.5.14, or 4.0.6 and later. Avoid using ${random.value}, ${random.int}, and ${random.long} for secret generation. Instead, use ${random.uuid} or other secure random generators. Patch status is not explicitly stated in the vendor advisory field, but fixed versions are identified. Therefore, apply the official fixes by upgrading to the specified versions to mitigate this vulnerability.