An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An attacker on the same network as the remote application may be able to utilize a timing attack to
    discover information about the remote secret. In extreme circumstances this could result in the attacker
    determining the secret and uploading changed classes, thereby achieving remote code execution in the
    remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15
    (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison.
    Versions that are no longer supported are also affected per vendor advisory. (CVE-2026-40972)

ID	Name	Product	Family	Type	Severity
464220	Echo: org.springframework.boot:spring-boot-devtools: security update to 3.5.14	Tenable Cloud Security	Echo Local Security Checks	Local	high
464220	Echo: org.springframework.boot:spring-boot-devtools: security update to 3.5.14	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
441409	SCA: security update for org.springframework.boot:spring-boot-devtools (GHSA-56v8-86gj-66jp)	Tenable Cloud Security	SCA Checks	Local	high
441409	SCA: security update for org.springframework.boot:spring-boot-devtools (GHSA-56v8-86gj-66jp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-40972

high

Tenable Plugins

high

high

high

high