CVE-2026-40992: CWE-295: Improper Certificate Validation in Spring Spring Boot
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
AI Analysis
Technical Summary
CVE-2026-40992 describes an improper certificate validation vulnerability (CWE-295) in Spring Boot's Mail auto-configuration. The default configuration does not enable hostname verification for SMTP SSL connections, potentially allowing man-in-the-middle attacks if hostname verification is not manually enabled. This affects Spring Boot versions 3.4.0 through 3.4.16, 3.5.0 through 3.5.14, and 4.0.0 through 4.0.6. Setting the JavaMail property 'spring.mail.properties.mail.smtp.ssl.checkserveridentity=true' mitigates the issue by enabling hostname verification.
Potential Impact
The vulnerability can lead to partial compromise of confidentiality, integrity, and availability of mail communications due to lack of hostname verification in SSL connections. This could allow attackers to impersonate mail servers under certain conditions. The CVSS score of 5.0 (medium) reflects the requirement for attacker proximity (network access with high complexity) and no privileges or user interaction needed.
Mitigation Recommendations
No official patch or fix is currently documented. However, applications can mitigate this vulnerability by explicitly setting the JavaMail property 'spring.mail.properties.mail.smtp.ssl.checkserveridentity=true' to enable hostname verification. This configuration change prevents the vulnerability without requiring a Spring Boot update. Monitor vendor advisories for any future official fixes.
CVE-2026-40992: CWE-295: Improper Certificate Validation in Spring Spring Boot
Description
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
CVSS v3.1
Score 5.0medium
Affected software
pkg:maven/org.springframework.boot/spring-bootRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40992 describes an improper certificate validation vulnerability (CWE-295) in Spring Boot's Mail auto-configuration. The default configuration does not enable hostname verification for SMTP SSL connections, potentially allowing man-in-the-middle attacks if hostname verification is not manually enabled. This affects Spring Boot versions 3.4.0 through 3.4.16, 3.5.0 through 3.5.14, and 4.0.0 through 4.0.6. Setting the JavaMail property 'spring.mail.properties.mail.smtp.ssl.checkserveridentity=true' mitigates the issue by enabling hostname verification.
Potential Impact
The vulnerability can lead to partial compromise of confidentiality, integrity, and availability of mail communications due to lack of hostname verification in SSL connections. This could allow attackers to impersonate mail servers under certain conditions. The CVSS score of 5.0 (medium) reflects the requirement for attacker proximity (network access with high complexity) and no privileges or user interaction needed.
Mitigation Recommendations
No official patch or fix is currently documented. However, applications can mitigate this vulnerability by explicitly setting the JavaMail property 'spring.mail.properties.mail.smtp.ssl.checkserveridentity=true' to enable hostname verification. This configuration change prevents the vulnerability without requiring a Spring Boot update. Monitor vendor advisories for any future official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- vmware
- Date Reserved
- 2026-04-16T02:19:09.389Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2a59ba318757064921d3aa
Added to database: 6/11/2026, 6:46:18 AM
Last enriched: 6/11/2026, 7:02:28 AM
Last updated: 6/11/2026, 1:28:48 PM
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.