Security
فارسی
All products

Red Hat Fuse 7/spring-boot

Red Hat · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Spring Boot accepts predictable temp directory without ownership verificationCVE-2026-40973 · GHSA-WWPQ-F5C3-7HVX org.springframework.boot:spring-bootRed Hat Fuse 7/spring-boot MavenRed Hat High Fix reported
Spring Boot has an Authentication Bypass under Actuator Health groups pathsCVE-2026-22731 · GHSA-8HFC-FQ58-R658 org.springframework.boot:spring-boot-starter-actuatorRed Hat Data Grid 8/spring-boot MavenRed Hat High Fix reported
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedCVE-2025-22235 · GHSA-RC42-6C7J-7H5R org.springframework.boot:spring-bootA-MQ Clients 2/spring-boot MavenRed Hat High Fix reported
Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ brokerCVE-2026-40971 · GHSA-9VC8-QPPQ-WVXC org.springframework.boot:spring-boot-rabbitmqRed Hat AMQ Broker 7/spring-boot MavenRed Hat Medium Fix reported
Spring Boot's PID file write follows symlinks at predictable default pathCVE-2026-40977 · GHSA-5368-6H4H-GR29 org.springframework.boot:spring-boot-cassandraRed Hat AMQ Broker 7/spring-boot MavenRed Hat Medium Fix reported
Spring Boot DevTools remote secret comparison is vulnerable to timing attacksCVE-2026-40972 · GHSA-56V8-86GJ-66JP org.springframework.boot:spring-boot-devtoolsRed Hat Fuse 7/spring-boot MavenRed Hat High Fix reported
Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verificationCVE-2026-40974 · GHSA-MQVW-JFMH-93QQ org.springframework.boot:spring-boot-cassandraRed Hat AMQ Broker 7/spring-boot MavenRed Hat Medium Fix reported
Spring Boot's random value property source uses a weak PRNG unsuitable for secretsCVE-2026-40975 · GHSA-M4X9-HX6X-2C43 org.springframework.boot:spring-boot-cassandraRed Hat Fuse 7/spring-boot MavenRed Hat Medium Fix reported
Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.CVE-2026-40970 · GHSA-C96X-RPM4-349P org.springframework.boot:spring-boot-elasticsearchRed Hat AMQ Broker 7/spring-boot MavenRed Hat Medium Fix reported