# CVE-2026-40972: VMware Spring Boot timing attack in DevTools remote secret comparison

Source: https://junglewise.ai/threats/cve-2026-40972-vmware-spring-boot-timing-attack-in-devtools-remote-secret  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-40972 · Severity: high · CVSS 7.5 · Published 2026-04-28

Spring Boot is a popular framework used by developers to build Java-based web applications. A security flaw in its development tools (DevTools) could allow an attacker on the same network to guess a secret password by measuring how long the server takes to respond to different requests. If successful, the attacker could gain full control over the application, allowing them to modify its behavior or execute malicious code.

Technologies: [VMware Spring Boot](https://junglewise.ai/threats/technologies/spring-boot). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-40972 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40972 being exploited in the wild.

**How severe is CVE-2026-40972?** High severity, with a CVSS score of 7.5, published 28 April 2026.

**Which products and versions are affected?** org.springframework.boot:spring-boot-devtools (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6; VMware Spring Boot 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32.

**Is there a fix for CVE-2026-40972?** Yes. org.springframework.boot:spring-boot-devtools (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40972 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-40972?** Check whether you run org.springframework.boot:spring-boot-devtools (Maven) or VMware Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.boot:spring-boot-devtools (Maven): upgrade to 4.0.6 or later

  ```sh
  # set org.springframework.boot:spring-boot-devtools to 4.0.6 in your pom.xml or build.gradle
  ```


## Technical details

A timing attack vulnerability (CWE-208) exists in the DevTools component of Spring Boot during the comparison of the remote secret. An attacker located on the same network (adjacent) can exploit observable timing discrepancies in the secret verification process to iteratively discover the correct secret. Once the secret is compromised, the attacker can use DevTools functionality to upload modified class files to the running application. This results in remote code execution (RCE) within the context of the application. The vulnerability is addressed in versions 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33.

## Affected products

- VMware Spring Boot 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32

## Identifiers

- CVE-2026-40972
- GHSA-56v8-86gj-66jp

## Timeline

- 2026-04-27: advisory: Initial advisory published by VMware
- 2026-04-28: disclosed: NVD publication date

## References

- [https://spring.io/security/cve-2026-40972](https://spring.io/security/cve-2026-40972)

## Related threats

- [VMware Spring Boot insecure directory in ArtemisEmbeddedConfigurationFactory](https://junglewise.ai/threats/cve-2026-41001-vmware-spring-boot-insecure-directory-in)
- [VMware Spring Boot improper certificate validation in Mail auto-configuration](https://junglewise.ai/threats/cve-2026-40992-vmware-spring-boot-improper-certificate-validation-in-mail-auto)
- [VMware Spring Boot link resolution vulnerability in ApplicationPidFileWriter](https://junglewise.ai/threats/cve-2026-40977-vmware-spring-boot-link-resolution-vulnerability-in)
- [Spring Boot authentication bypass in default web security filter chain](https://junglewise.ai/threats/cve-2026-40976-spring-boot-authentication-bypass-in-default-web-security-filter)
- [Spring Boot weak PRNG in random value property source](https://junglewise.ai/threats/cve-2026-40975-spring-boot-weak-prng-in-random-value-property-source)