Executive brief
Spring Boot is a popular framework used to build Java-based enterprise applications. A security issue in its Cassandra database connector means that applications may not verify the identity of the database server they are connecting to. This could allow an attacker on the same network to intercept or modify sensitive data by impersonating the database server.
Technical details
A vulnerability exists in Spring Boot's Cassandra auto-configuration where hostname verification is not performed during the SSL handshake. This is classified as Improper Certificate Validation (CWE-295). An attacker with adjacent network access could perform a man-in-the-middle (MITM) attack to intercept or spoof traffic between the Spring Boot application and the Cassandra database. The vulnerability affects multiple release trains including 2.7.x, 3.3.x, 3.4.x, 3.5.x, and 4.0.x. Users should upgrade to the respective fix versions (e.g., 4.0.6, 3.5.14) to ensure proper certificate validation is enforced.
Affected products
- VMware Spring Boot 2.7.0–2.7.32, 3.3.0–3.3.18, 3.4.0–3.4.15, 3.5.0–3.5.13, 4.0.0–4.0.5
Timeline
- 2026-04-27: advisory: Initial advisory published by VMware
- 2026-04-28: disclosed: NVD publication date