VIR Vulnerability Intelligence Relay

CVE-2026-40977

medium
Published 2026-04-28 · Modified 2026-05-06
CVSS v3
6.7
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
CVSS v2
—
VIR risk
6.7

Description

Spring Boot's PID file write follows symlinks at predictable default path

Predictions

Exploit likelihood
66%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security@vmware.com — https://spring.io/security/cve-2026-40977

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.springframework.boot:spring-boot-cassandra>=4.0.0,<4.0.64.0.6
java Mavenorg.springframework.boot:spring-boot-cassandra>=3.5.0,<3.5.143.5.14
java Mavenorg.springframework.boot:spring-boot-cassandra>=3.4.0,<=3.4.15
java Mavenorg.springframework.boot:spring-boot-cassandra>=3.3.0,<=3.3.18
java Mavenorg.springframework.boot:spring-boot-cassandra<=2.7.32
java MAVENorg.springframework.boot:spring-boot-cassandra<= 2.7.32
java MAVENorg.springframework.boot:spring-boot-cassandra>= 3.3.0, <= 3.3.18
java MAVENorg.springframework.boot:spring-boot-cassandra>= 3.4.0, <= 3.4.15
java MAVENorg.springframework.boot:spring-boot-cassandra>= 3.5.0, < 3.5.143.5.14
java MAVENorg.springframework.boot:spring-boot-cassandra>= 4.0.0, < 4.0.64.0.6

Application impact
VendorProductVersionsFixed
vmwarespring_boot{"endExcluding":"2.7.33"}2.7.33

References

CWEs

CWE-59

Verify integrity in audit chain (admin only). AS-IS.