CVE-2026-40975: Spring Boot weak PRNG in random value property source

CVE-2026-40975 · Severity: medium · CVSS 4.8 · Published 2026-04-28

Spring Boot, a widely used framework for building Java applications, contains a security flaw in how it generates random values. If developers use certain built-in random functions to create sensitive items like passwords or security tokens, those secrets may be predictable. This could allow an attacker to guess security credentials and gain unauthorized access to protected data or systems.

Technologies: org.springframework.boot:spring-boot-cassandra (Maven), Red Hat build of Apache Camel for Spring Boot, VMware Spring Boot. Vendors: Maven, Red Hat, VMware.

Quick answers

Is CVE-2026-40975 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40975 being exploited in the wild.
How severe is CVE-2026-40975?
Medium severity, with a CVSS score of 4.8, published 28 April 2026.
Which products and versions are affected?
org.springframework.boot:spring-boot-cassandra (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6; Red Hat HawtIO 4.4.0; Red Hat build of Apache Camel for Spring Boot 4.18.1; Red Hat Data Grid 8.6.1; and 1 more.
Is there a fix for CVE-2026-40975?
Yes. org.springframework.boot:spring-boot-cassandra (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40975 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40975?
Check whether you run org.springframework.boot:spring-boot-cassandra (Maven), Red Hat HawtIO, Red Hat build of Apache Camel for Spring Boot or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.boot:spring-boot-cassandra (Maven): upgrade to 4.0.6 or later
    # set org.springframework.boot:spring-boot-cassandra to 4.0.6 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Spring Boot's random value property source where the '${random.value}', '${random.int}', and '${random.long}' functions use an insufficiently random or predictable range. This constitutes a use of a cryptographically weak Pseudo-Random Number Generator (PRNG) (CWE-338). While '${random.uuid}' is unaffected, the other functions produce values that can be predicted by an attacker. If these values are used to generate security secrets, session tokens, or encryption keys, an attacker could potentially perform information disclosure or bypass authentication. Patches are available in Spring Boot versions 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33.

Affected products

  • VMware Spring Boot 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4.18.1
  • Red Hat HawtIO 4.4.0
  • Red Hat Red Hat Data Grid 8.6.1

Identifiers

  • CVE-2026-40975
  • GHSA-m4x9-hx6x-2c43

Timeline

  • 2026-04-28: disclosed
  • 2026-04-28: advisory
  • 2026-05-14: patched: Red Hat release of patches for Camel Spring Boot

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.