CVE-2026-40977: 
Java vulnerability analysis and mitigation

CVE-2026-40977 is a symlink-following vulnerability in Spring Boot's ApplicationPidFileWriter component, classified as PID file write follows symlinks at predictable default path. When an application uses ApplicationPidFileWriter, a local attacker with write access to the PID file's location can corrupt an arbitrary file on the host each time the application is started. Affected versions include Spring Boot 2.7.0–2.7.32, 3.3.0–3.3.18, 3.4.0–3.4.15, 3.5.0–3.5.13, and 4.0.0–4.0.5; unsupported versions are also affected. The vulnerability was initially reported on April 23, 2026, and published to NVD and the GitHub Advisory Database on April 28, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium) per the vendor and GitHub Advisory (Spring Advisory, GitHub Advisory).

The root cause is CWE-59 (Improper Link Resolution Before File Access / 'Link Following'): ApplicationPidFileWriter writes the application's process ID to a file at a predictable default path without verifying whether that path is a symbolic link. A local attacker who can place a symlink at the PID file location before application startup can redirect the write operation to an arbitrary target file, causing its contents to be overwritten with the PID value. Exploitation requires local access and write permissions to the PID file directory, as well as high privileges on the system, making this a local privilege-abuse scenario rather than a remote attack. No public proof-of-concept code has been identified (Spring Advisory, GitHub Advisory).

Successful exploitation allows a local attacker to corrupt an arbitrary file on the host system each time the vulnerable Spring Boot application is started, resulting in high availability impact (targeted file destruction or service disruption) and limited integrity impact (file content overwritten with a PID value). Confidentiality is not directly impacted, as no data is disclosed. Depending on the targeted file, consequences could range from crashing dependent services to corrupting critical system or application configuration files, potentially enabling further privilege escalation or denial of service (GitHub Advisory, Spring Advisory).

1. Reconnaissance: Identify a target host running a Spring Boot application configured with ApplicationPidFileWriter, and confirm the PID file's default or configured path (commonly /tmp/application.pid or a path specified in application.properties).
2. Gain local write access: Obtain local access to the host with write permissions to the directory containing the PID file (requires high privileges or a pre-existing foothold).
3. Place a symlink: Before the Spring Boot application starts (or after stopping it), remove the existing PID file if present and create a symbolic link at the PID file path pointing to the target file to be corrupted (e.g., ln -s /etc/cron.d/target /tmp/application.pid).
4. Trigger application startup: Start or restart the Spring Boot application. ApplicationPidFileWriter will follow the symlink and overwrite the target file with the application's PID value.
5. Achieve objective: The targeted file is now corrupted with the PID content, potentially disrupting services, corrupting configurations, or enabling further attack steps depending on the file targeted (Spring Advisory, GitHub Advisory).

• File System: Presence of a symbolic link at the application's configured PID file path (e.g., /tmp/application.pid) pointing to an unexpected target file; unexpected modification timestamps or content changes on system or application files coinciding with Spring Boot application restarts.
• Logs: Application startup logs showing ApplicationPidFileWriter activity; OS-level audit logs (e.g., auditd) recording symlink creation (symlink or rename syscalls) at the PID file location by a non-application user prior to application startup.
• Process: Unexpected file write events to sensitive paths (e.g., /etc/, /var/) originating from the Spring Boot JVM process at startup time, detectable via file integrity monitoring tools.

Users should upgrade to the fixed Spring Boot versions: 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33, depending on their current version branch. No additional workaround steps are required beyond upgrading, per the vendor advisory. As a defense-in-depth measure, restrict write access to the PID file directory to only the application service account, and implement file integrity monitoring on PID file locations to detect unexpected symlink creation. IBM products using Spring Boot (API Connect, Instana Observability, Business Automation Manager Open Editions, Library Support for Spring) have separate advisories and should be patched per IBM guidance (Spring Advisory, IBM Advisory).

Spring (Broadcom/VMware) published the initial advisory on April 23, 2026, rating the vulnerability as Medium severity. HeroDevs covered the vulnerability in a blog post summarizing Spring Boot's April 2026 CVEs, noting this alongside other issues disclosed in the same release cycle (HeroDevs Blog). IBM issued multiple advisories for affected downstream products in May 2026. No significant social media controversy or researcher debate has been observed, consistent with the vulnerability's moderate severity and limited exploitability.