Ghostwire

CVE-2026-40992: Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail...

MEDIUM CVSS 5.0 Exploit Available

Published: June 11, 2026 | Last Modified: June 11, 2026

Description

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.

Ghostwire Analysis — What This Means Practically

Medium CVSS score indicates moderate risk — exploitation requires specific conditions or results in limited impact.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

CVE-2026-40992: Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail...

Description

Ghostwire Analysis — What This Means Practically

Security Coverage (1 articles)

References