CVE-2026-40972: 
Java vulnerability analysis and mitigation

CVE-2026-40972 is a timing attack vulnerability in Spring Boot DevTools' remote secret comparison mechanism, classified as High severity. An attacker on the same network can exploit observable timing discrepancies during secret validation to progressively determine the remote secret, and in extreme cases upload malicious classes to achieve remote code execution. It was initially reported on April 23, 2026, and published to the NVD and GitHub Advisory Database on April 28, 2026. Affected versions span Spring Boot 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32, as well as older unsupported versions. The CVSS v3.1 base score is 7.5 (High) (Spring Advisory, GitHub Advisory).

The vulnerability is classified as CWE-208 (Observable Timing Discrepancy), arising from the Spring Boot DevTools remote secret comparison not using a constant-time comparison algorithm. When the DevTools remote restart feature is enabled, the application compares a shared secret to authenticate requests; because the comparison terminates early on a mismatch, an adjacent network attacker can measure response time differences to infer correct secret characters byte-by-byte. Once the full secret is recovered, the attacker can authenticate to the DevTools remote endpoint and upload modified class files, leading to arbitrary code execution. The attack requires no privileges and no user interaction, but does require high attack complexity and network adjacency (CAPEC-462: Cross-Domain Search Timing) (Spring Advisory, GitHub Advisory).

Successful exploitation grants an attacker full control over the affected Spring Boot application, with high confidentiality, integrity, and availability impacts. By uploading malicious classes via the DevTools remote endpoint, an attacker can execute arbitrary code in the context of the application server, potentially enabling data exfiltration, lateral movement within the network, or complete service disruption. The scope is limited to the vulnerable component itself, but the ability to execute arbitrary code makes this a severe outcome for any environment where DevTools remote is inadvertently enabled (Spring Advisory, GitHub Advisory).

1. Reconnaissance: Identify Spring Boot applications on the local network segment with DevTools remote restart enabled, typically listening on a specific HTTP endpoint (e.g., /.~~spring-boot!~/restart). Tools like Nmap or network scanners can identify candidate hosts and open ports.
2. Confirm DevTools remote is active: Send a probe request to the DevTools remote endpoint and observe whether the server responds with timing-sensitive behavior, confirming the feature is enabled and the secret comparison is occurring.
3. Perform timing attack: Iteratively send authentication requests with candidate secret values, measuring response times for each attempt. Because the non-constant-time comparison exits early on a mismatch, correct prefix bytes produce measurably longer response times. Repeat this process character-by-character to reconstruct the full secret.
4. Authenticate with recovered secret: Use the discovered secret to craft a valid authenticated request to the DevTools remote endpoint.
5. Upload malicious classes: Submit a crafted payload containing modified or malicious Java class files via the authenticated DevTools remote restart mechanism, causing the application to load and execute attacker-controlled code (Spring Advisory, GitHub Advisory).

• Network: High volume of repeated HTTP requests to the Spring Boot DevTools remote endpoint (e.g., /.~~spring-boot!~/restart) from a single adjacent network host, especially with slight variations in request payloads; unusual timing patterns in HTTP traffic to DevTools ports.
• Logs: Application logs showing repeated authentication failures or secret comparison attempts against the DevTools remote endpoint; sudden successful authentication to the DevTools endpoint from an unexpected source IP.
• File System: Unexpected or newly modified .class files in the application's classpath or temporary directories; new JAR files or class artifacts not matching the original deployment.
• Process: Unusual child processes spawned by the Spring Boot JVM process; unexpected outbound network connections initiated by the application after a DevTools remote restart event.

Spring has released patched versions addressing this vulnerability: upgrade to Spring Boot 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33 depending on your current branch. Note that fixes for 3.4.x, 3.3.x, and 2.7.x are available under Enterprise Support only. As an immediate workaround, disable Spring Boot DevTools in production environments (DevTools is typically excluded from production builds by default, but should be explicitly verified). Additionally, restrict network access to DevTools endpoints to trusted networks only, and monitor for suspicious adjacent-network activity targeting DevTools ports (Spring Advisory, GitHub Advisory).

The Belgian Centre for Cybersecurity (CCB) issued an advisory urging immediate patching for multiple Spring Boot vulnerabilities including CVE-2026-40972. HeroDevs published a blog post covering the April 2026 Spring Boot CVE batch, noting the significance of the timing attack vector. The vulnerability received coverage from threat intelligence aggregators and security digest services, with general community consensus that the risk is mitigated by the high attack complexity and the fact that DevTools should not be enabled in production. No significant controversy or notable researcher commentary beyond standard patch advisories has been observed (HeroDevs Blog, GitHub Advisory).