CVE catalog

CVE-2026-40970

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affected: Spring Boot 4.0.0–4.

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

A flaw was found in Spring Boot. When configured to use an SSL (Secure Sockets Layer) bundle, the Elasticsearch auto-configuration component does not perform hostname verification when establishing a connection to the Elasticsearch server. An attacker on an adjacent network could exploit this by performing a man-in-the-middle attack. This could lead to the disclosure or modification of sensitive information exchanged between Spring Boot and the Elasticsearch server. Spring Boot: Spring Boot: Missing hostname verification in Elasticsearch auto-configuration allows information disclosure The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpespring_bootNot reported4.0.6fixed
Cpespring_bootNot reported4.0.6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpespring_bootcpeNot reported4.0.6Not reportedNot reportedNot reported
Cpespring_bootcpeNot reported4.0.6Not reportedNVD-CVE-2026-40970Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]