Threats tagged 'ghsa-m4x9-hx6x-2c43'

Spring Boot versions prior to 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33 use a weak pseudorandom number generator (PRNG) for the ${random.value} property source, making values generated unsuitable for use as secrets. The ${random.uuid} property is not affected. Numeric random values such as ${random.int} and ${random.long} are also not suitable for secrets due to their predictable ranges. This vulnerability is identified as CVE-2026-40975 and has a medium severity rating with a CVSS score of 4.8.