{"advisories":[{"id":"GHSA-9wxp-w4px-32vh","source":"ghsa","title":"Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification","url":"https://github.com/advisories/GHSA-9wxp-w4px-32vh"}],"cve":"CVE-2026-40992","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[4.0.0,4.0.7)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.5.0,3.5.15)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[3.4.0,3.4.17)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"Spring Boot","source":"cna","vendor":"Spring"},"product":"spring_boot","vendor":"spring"}],"created":"2026-06-11T07:30:08.283459+00:00","updated":"2026-06-11T07:30:08.609349+00:00","vendors":["spring","spring$PRODUCT$spring_boot"]},"epss":{"score":0.00124},"mitre":{"cpes":[],"created":"2026-06-11T05:03:53.539000+00:00","description":"Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.\n\nAffected versions:\nSpring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/40xxx/CVE-2026-40992.json","references":["https://spring.io/security/cve-2026-40992"],"title":"Mail Auto-Configuration Does Not Enable SSL Hostname Verification","updated":"2026-06-23T19:46:36.493000+00:00","vendors":[],"weaknesses":["CWE-295"]},"nvd":{"cpes":["cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*"],"created":"2026-06-11T07:16:27.177000+00:00","description":"Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.\n\nAffected versions:\nSpring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.0,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-40992.json","references":["https://spring.io/security/cve-2026-40992"],"title":null,"updated":"2026-09-04T18:05:38.580000+00:00","vendors":["vmware","vmware$PRODUCT$spring_boot"],"weaknesses":["CWE-295"]},"opencve":{"changes":[{"created":"2026-06-11T06:45:00+00:00","data":[{"details":{"new":"Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.\n\nAffected versions:\nSpring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.","old":null},"type":"description"},{"details":{"new":"Mail Auto-Configuration Does Not Enable SSL Hostname Verification","old":null},"type":"title"},{"details":{"added":["CWE-295"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://spring.io/security/cve-2026-40992"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"8accd52d-1a02-4989-a792-04fb1e21b80f"},{"created":"2026-06-11T07:45:00+00:00","data":[{"details":["spring","spring$PRODUCT$spring_boot"],"type":"first_time"},{"details":{"added":["spring","spring$PRODUCT$spring_boot"],"removed":[]},"type":"vendors"}],"id":"df18cf0e-bf2d-47cf-ab9c-1d616b293819"},{"created":"2026-06-12T23:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"e6ce8812-d317-4c49-8cd0-3145685cc518"},{"created":"2026-09-04T18:15:00+00:00","data":[{"details":["vmware","vmware$PRODUCT$spring_boot"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["vmware","vmware$PRODUCT$spring_boot"],"removed":[]},"type":"vendors"}],"id":"05f18375-c81d-46f2-9e86-0b3e12159a77"}],"cpes":{"data":["cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-06-11T05:03:53.539000+00:00","provider":"mitre"},"description":{"data":"Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.\n\nAffected versions:\nSpring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00124},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://spring.io/security/cve-2026-40992"],"providers":["mitre","nvd"]},"title":{"data":"Mail Auto-Configuration Does Not Enable SSL Hostname Verification","provider":"mitre"},"updated":{"data":"2026-09-04T18:05:38.580000+00:00","provider":"nvd"},"vendors":{"data":["spring","spring$PRODUCT$spring_boot","vmware","vmware$PRODUCT$spring_boot"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-295"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-06-11T05:03:53.539000+00:00","description":"Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.\n\nAffected versions:\nSpring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"Mail Auto-Configuration Does Not Enable SSL Hostname Verification","updated":"2026-06-11T12:45:56.759000+00:00","vendors":[],"vulnrichment_repo_path":"2026/40xxx/CVE-2026-40992.json","weaknesses":[]}}