Spring Boot versions 4.0.0 through 4.0.5 include a vulnerability in the Elasticsearch auto-configuration when using an SSL bundle. The vulnerability is due to the lack of hostname verification during SSL connections to the Elasticsearch server. This flaw could allow an attacker to perform man-in-the-middle attacks by presenting a certificate for a different hostname. The issue is fixed in Spring Boot version 4.0.6 and later.