Junglewise Threat Intelligence

CVE-2026-40975: Spring Boot weak PRNG in random value property source

CVE-2026-40975 · Severity: medium · CVSS 4.8 · Published 2026-04-28

Technologies: VMware Spring Boot, Red Hat build of Apache Camel for Spring Boot. Vendors: Red Hat, VMware.

Executive brief

Spring Boot, a widely used framework for building Java applications, contains a security flaw in how it generates random values. If developers use certain built-in random functions to create sensitive items like passwords or security tokens, those secrets may be predictable. This could allow an attacker to guess security credentials and gain unauthorized access to protected data or systems.

Technical details

A vulnerability exists in Spring Boot's random value property source where the '${random.value}', '${random.int}', and '${random.long}' functions use an insufficiently random or predictable range. This constitutes a use of a cryptographically weak Pseudo-Random Number Generator (PRNG) (CWE-338). While '${random.uuid}' is unaffected, the other functions produce values that can be predicted by an attacker. If these values are used to generate security secrets, session tokens, or encryption keys, an attacker could potentially perform information disclosure or bypass authentication. Patches are available in Spring Boot versions 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33.

Affected products

  • VMware Spring Boot 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4.18.1
  • Red Hat HawtIO 4.4.0
  • Red Hat Red Hat Data Grid 8.6.1

Timeline

  • 2026-04-28: disclosed
  • 2026-04-28: advisory
  • 2026-05-14: patched: Red Hat release of patches for Camel Spring Boot

References

Related threats