CVE-2026-40992 is a vulnerability in Spring Boot's Mail auto-configuration that results in improper certificate validation due to hostname verification being disabled by default. This affects Spring Boot versions 3.4.0 through 3.4.16, 3.5.0 through 3.5.14, and 4.0.0 through 4.0.6. The vulnerability is identified as CWE-295 (Improper Certificate Validation). Applications that explicitly enable hostname verification by setting the JavaMail property spring.mail.properties.mail.smtp.ssl.checkserveridentity=true are not vulnerable. No official patch or remediation level has been published yet.

The vulnerability allows for potential man-in-the-middle attacks or interception of mail server communications due to the lack of hostname verification in SSL/TLS connections. This can lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, the impact is mitigated if the relevant JavaMail property is set to enable hostname verification.

Currently, no official patch or fix has been published. To mitigate this vulnerability, applications should explicitly enable hostname verification by setting the JavaMail property spring.mail.properties.mail.smtp.ssl.checkserveridentity=true in their configuration. This setting disables the vulnerability by enforcing proper certificate validation. Monitor the vendor advisory for any future official fixes or updates.