Executive brief
Spring Boot is a popular framework used to build Java-based web applications. A security issue exists where applications connecting to Elasticsearch databases may fail to verify the identity of the server they are talking to. This could allow an attacker on the same network to intercept or modify sensitive data by impersonating the database server.
Technical details
A CWE-295 (Improper Certificate Validation) vulnerability exists in Spring Boot's Elasticsearch auto-configuration component. When the application is configured to use SSL bundles for secure communication, it fails to perform hostname verification during the TLS handshake with the Elasticsearch server. An attacker with adjacent network access could perform a man-in-the-middle (MitM) attack to intercept or spoof communications between the application and the database. This issue affects Spring Boot versions 4.0.0 through 4.0.5 and is resolved in version 4.0.6.
Affected products
- VMware Spring Boot 4.0.0 to 4.0.5
Timeline
- 2026-04-27: disclosed
- 2026-04-27: advisory: VMware published vendor advisory
- 2026-05-14: other: NVD initial analysis completed