Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification, which means it does not verify the hostname when establishing an SSL connection to Cassandra. This affects multiple Spring Boot versions prior to their respective fixes. The vulnerability is fixed in versions 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33. The CVSS score is 5.0, indicating a medium severity issue.
Spring Boot versions 2.7.0 through 2.7.32, 3.3.0 through 3.3.18, 3.4.0 through 3.4.15, 3.5.0 through 3.5.13, and 4.0.0 through 4.0.5 contain a vulnerability where the application accepts a predictable temporary directory without verifying ownership. This can allow a local attacker on the same host to take control of the directory used by ApplicationTemp. If server.servlet.session.persistent is enabled, the attacker may read session data, hijack authenticated users, or execute code as the application user. Fixed versions are available starting from 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6.
Spring Boot versions prior to 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33 use a weak pseudorandom number generator (PRNG) for the ${random.value} property source, making values generated unsuitable for use as secrets. The ${random.uuid} property is not affected. Numeric random values such as ${random.int} and ${random.long} are also not suitable for secrets due to their predictable ranges. This vulnerability is identified as CVE-2026-40975 and has a medium severity rating with a CVSS score of 4.8.
Spring Boot versions 4.0.0 through 4.0.5 have a critical security vulnerability where the default web security filter chain lacks authorization rules under specific conditions. This flaw allows unauthorized access to all endpoints if the application is servlet-based, relies on the default security configuration without custom Spring Security settings, depends on spring-boot-actuator-autoconfigure, and does not depend on spring-boot-health. The issue is fixed in version 4.0.6.
Spring Boot's RabbitMQ auto-configuration in versions 3.5.0 through 3.5.13 and 4.0.0 through 4.0.5 does not perform hostname verification when using an SSL bundle to connect to the RabbitMQ broker. This vulnerability is fixed in versions 3.5.14 and 4.0.6.
A timing attack vulnerability exists in the remote secret comparison mechanism of Spring Boot DevTools. An attacker on the same network could exploit this to infer the remote secret, potentially allowing them to upload modified classes and achieve remote code execution. This affects multiple Spring Boot versions prior to fixed releases.
Spring Boot versions 4.0.0 through 4.0.5 include a vulnerability in the Elasticsearch auto-configuration when using an SSL bundle. The vulnerability is due to the lack of hostname verification during SSL connections to the Elasticsearch server. This flaw could allow an attacker to perform man-in-the-middle attacks by presenting a certificate for a different hostname. The issue is fixed in Spring Boot version 4.0.6 and later.
Apache Storm versions prior to 2.8.7 improperly handle TLS client authentication failures by assigning a fallback anonymous principal (CN=ANONYMOUS) when client certificates are missing or fail verification. This fail-open behavior allows unauthenticated clients to establish TLS connections and potentially bypass authorization if access controls do not explicitly deny the anonymous principal. The issue is logged only at debug level, reducing detection likelihood in production environments. The vulnerability is fixed in version 2.8.7.
Apache Storm Prometheus Reporter versions 2.6.3 through 2.8.6 have an improper certificate validation vulnerability caused by a global SSL context downgrade when the skip_tls_validation option is enabled. This insecure configuration disables SSL certificate checks JVM-wide, allowing man-in-the-middle attacks on all TLS connections within the Storm daemon process. The issue is fixed in version 2.8.7.
The Apache Camel-Infinispan component versions 4.0.0 before 4.14.7, 4.15.0 before 4.18.2, and 4.19.0 before 4.20.0 contain a deserialization vulnerability. This occurs because the ProtoStream-based remote aggregation repository deserializes data from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker able to write malicious serialized Java objects to the cache can trigger arbitrary code execution during normal repository operations. The issue is fixed in versions 4.14.7, 4.18.2, and 4.20.0.
The Apache Camel Consul component contains a deserialization vulnerability in the ConsulRegistry class, where untrusted Java-serialized data from the Consul KV store is deserialized without proper filtering. This allows an attacker with write access to the Consul KV store to inject malicious serialized objects, potentially leading to arbitrary code execution within the Camel process. The vulnerability affects Apache Camel versions from 3.0.0 before 4.14.6 and from 4.15.0 before 4.18.1. Fixed versions include 4.14.6, 4.18.1, and later 4.19.0. Users are advised to upgrade to these versions to mitigate the risk.
Apache Camel versions from 4.14.1 before 4.14.6, 4.18.0 before 4.18.2, and 4.19.0 before 4.20.0 have an authentication bypass vulnerability in the embedded HTTP and management servers when authentication is enabled and non-root context paths are used. This flaw allows unauthenticated access to subpaths of protected endpoints, potentially exposing sensitive runtime metadata. The issue is fixed in versions 4.14.6, 4.18.2, and 4.20.0.
Apache MINA versions 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, and 2.2.0 through 2.2.5 contain a deserialization vulnerability due to an incomplete fix for CVE-2024-52046. The classname allowlist intended to restrict deserialization was applied too late, allowing unsafe classes to be deserialized. This issue is resolved in versions 2.0.28, 2.1.11, and 2.2.6 by applying the allowlist earlier in the deserialization process. Applications using Apache MINA that invoke IoBuffer.getObject() are affected and should upgrade to the fixed versions.
Apache Camel's camel-coap component versions 4.14.0 through 4.14.5 and 4.18.0 before 4.18.1 are vulnerable to header injection. This occurs because CoAP request URI query parameters are mapped directly into Camel message headers without filtering. An unauthenticated attacker can exploit this to inject arbitrary internal headers, potentially leading to remote code execution when the exchange is forwarded to a header-sensitive downstream producer such as camel-exec. The vulnerability is fixed in versions 4.14.6, 4.18.1, and 4.19.0.
Apache MINA versions 2.0.0 through 2.0.27, 2.1.0 through 2.1.10, and 2.2.0 through 2.2.5 contain a deserialization vulnerability in AbstractIoBuffer.resolveClass() that allows bypassing the classname allowlist, leading to arbitrary code execution. The issue is fixed in versions 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier in the deserialization process. Applications using Apache MINA that invoke IoBuffer.getObject() are affected and should upgrade to the fixed versions.
The Apache Camel camel-mina component is vulnerable to deserialization of untrusted data due to lack of ObjectInputFilter or class-loading restrictions when converting IoBuffer to ObjectInputStream. This allows an attacker to send crafted serialized Java objects over the network to trigger arbitrary code execution during deserialization. The vulnerability affects versions from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, and from 4.19.0 before 4.20.0. Fixed versions include 4.14.6, 4.18.2, and 4.20.0. The CVSS score is 8.8 (high severity).
The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was not applied to five non-HTTP HeaderFilterStrategy implementations: JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub. Because those strategies use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map, an attacker with JMS (or equivalent) producer access to the broker consumed by a Camel route can inject case-variant Camel internal headers, which are then resolved by downstream components such as camel-exec and camel-file using their canonical casing. This enables remote code execution and arbitrary file write on routes that forward JMS messages to header-driven components.
This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0.
Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
Apache Camel's camel-pqc component versions before 4.18.2 and from 4.19.0 before 4.20.0 contain a deserialization vulnerability in the FileBasedKeyLifecycleManager class. This class deserializes key files without applying object input filtering, allowing an attacker with write access to the key directory to execute arbitrary code. The vulnerability is fixed in versions 4.18.2 and 4.20.0 by replacing the insecure deserialization mechanism with a safer Base64 JSON encoding format for keys.
A code injection vulnerability exists in the DsSpelExpressionProcessor#doDetermineDatasource function of the com.baomidou dynamic-datasource-spring component version 4.5.0 and earlier. This vulnerability allows remote attackers with limited privileges to manipulate the StandardEvaluationContext/SpelExpressionParser, potentially leading to partial confidentiality, integrity, and availability impacts. A patch is recommended to remediate this issue.
CVE-2026-33524 is a high-severity vulnerability in the Zserio Runtime serialization framework affecting versions prior to 2.18.1. It allows an attacker to trigger unbounded memory allocation via crafted payloads, potentially causing denial of service by crashing processes due to out-of-memory errors. This impacts both C++ and Java runtimes used in automotive systems, including the Navigation Data Standard (NDS) deployed in millions of vehicles. A patch is available in version 2.18.1.