{"schemaVersion":3,"id":"CVE-2026-40973","aliases":["CGA-42gh-5r7q-cf22","CGA-4xmc-frgf-8xfw","CGA-6xf4-v4h9-4wp3","CGA-7987-h328-mc25","CGA-7cg3-gr2v-35pg","CGA-7f8j-5mp2-9jcv","CGA-g9p3-9gqc-44mv","CGA-m2m4-v5xc-v23j","CGA-mcp4-cjpm-xfpx","CGA-p3fq-w84m-w7fx","CGA-pq5p-hxjm-xcw2","CGA-v644-pvfq-xv79","CGA-wwrp-x3x7-v393","CGA-x6fc-39gf-w4cw","CGA-xhpf-g7fc-p5jc","CGA-2p9g-gx2f-9wq5","CGA-2qm6-3mf3-gv8w","CGA-2wfw-47cr-g56r","CGA-3vhg-mv9j-g73j","CGA-533g-xpv5-r48p","CGA-63mh-849w-h24c","CGA-6cc2-5h2v-6mv2","CGA-8hq9-2hxj-9r5f","CGA-9wp8-x238-x329","CGA-c2g7-m44c-2gfx","CGA-ccr2-qxh7-m74g","CGA-fh53-2c48-mqc5","CGA-fj42-q28c-8h89","CGA-fvpm-5jw2-3ww7","CGA-fx3q-53mh-8j7p","CGA-g6f8-pvqp-x44f","CGA-gwm3-5cr2-5wm6","CGA-hfm8-x4gr-q3vv","CGA-j742-2x3v-whpp","CGA-j8j2-cm5j-x5c6","CGA-mc5g-7mrx-gpm9","CGA-p73g-92mm-gfx5","CGA-pcgw-qxxh-pfmq","CGA-pfp3-fqg4-frpf","CGA-pv7f-wr92-p5p6","GHSA-wwpq-f5c3-7hvx","CGA-qgc4-6r4v-vph9","CGA-r47x-v8hv-xh27","CGA-r69j-85v8-p73v","CGA-rhc7-926v-35wh","CGA-vj7w-8rwp-2frh","CGA-w364-jphr-gm54","CGA-w89f-rhxp-2jvc","CGA-wjgg-8r8q-pqh6","CGA-wx8f-6qp4-577g","CGA-x4wx-966c-hpgw","CGA-xm95-v47f-39ff"],"status":"published","duplicateOf":null,"title":null,"description":"A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.\n\nAffected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / `ApplicationTemp` ownership verification. Versions that are no longer supported are also affected per vendor advisory.","dates":{"published":"2026-04-27T23:29:51.946Z","modified":"2026-04-29T03:55:43.148Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7,"severity":"high","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7,"severity":"high","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":2.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7,"severity":"high","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":2.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":7,"severity":"high","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":2.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7,"severity":"high","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00134,"percentile":0.02611,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":-0.0020000000000000052,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00136},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00134,"percentile":0.02611}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00136,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00134,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00134,"percentile":0.02611}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-377","name":"Insecure Temporary File","description":"Creating and using insecure temporary files can leave application and system data vulnerable to attack.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/377.html"}],"affected":[{"vendor":"chainguard","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.9.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-registry-toolkit","name":"apache-nifi-registry-toolkit","label":"apache-nifi-registry-toolkit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry-toolkit","purlType":"apk","versions":[{"text":"< 2.9.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.6","name":"camunda-zeebe-8.6","label":"camunda-zeebe-8.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.6","purlType":"apk","versions":[{"text":"< 8.6.39-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.6.39-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.7","name":"camunda-zeebe-8.7","label":"camunda-zeebe-8.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.7","purlType":"apk","versions":[{"text":"< 8.7.29-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.7.29-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.8","name":"camunda-zeebe-8.8","label":"camunda-zeebe-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.8","purlType":"apk","versions":[{"text":"< 8.8.24-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.24-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.9","name":"camunda-zeebe-8.9","label":"camunda-zeebe-8.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.9","purlType":"apk","versions":[{"text":"< 8.9.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.9.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"conductor","name":"conductor","label":"conductor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/conductor","purlType":"apk","versions":[{"text":"< 3.31.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.31.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"conductor-fips","name":"conductor-fips","label":"conductor-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/conductor-fips","purlType":"apk","versions":[{"text":"< 3.31.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.31.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui","name":"kafbat-ui","label":"kafbat-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui","purlType":"apk","versions":[{"text":"< 1.4.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui-fips","name":"kafbat-ui-fips","label":"kafbat-ui-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui-fips","purlType":"apk","versions":[{"text":"< 1.4.2-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.0","name":"kayenta-2025.0","label":"kayenta-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.1","name":"kayenta-2025.1","label":"kayenta-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.2","name":"kayenta-2025.2","label":"kayenta-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.0","name":"kayenta-fips-2025.0","label":"kayenta-fips-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.1","name":"kayenta-fips-2025.1","label":"kayenta-fips-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.2","name":"kayenta-fips-2025.2","label":"kayenta-fips-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keycloak-config-cli-iamguarded-compat","name":"keycloak-config-cli-iamguarded-compat","label":"keycloak-config-cli-iamguarded-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keycloak-config-cli-iamguarded-compat","purlType":"apk","versions":[{"text":"< 6.5.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.5.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos","name":"nacos","label":"nacos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos","purlType":"apk","versions":[{"text":"< 3.2.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos-docker","name":"nacos-docker","label":"nacos-docker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos-docker","purlType":"apk","versions":[{"text":"< 3.2.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ontop","name":"ontop","label":"ontop","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ontop","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ontop-fips","name":"ontop-fips","label":"ontop-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ontop-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"seata-server","name":"seata-server","label":"seata-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/seata-server","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 4.3.1.1-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zipkin","name":"zipkin","label":"zipkin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zipkin","purlType":"apk","versions":[{"text":"< 3.6.1-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.1-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"zipkin-slim","name":"zipkin-slim","label":"zipkin-slim","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/zipkin-slim","purlType":"apk","versions":[{"text":"< 3.6.1-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.1-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.9.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry-toolkit","name":"apache-nifi-registry-toolkit","label":"apache-nifi-registry-toolkit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry-toolkit","purlType":"apk","versions":[{"text":"< 2.9.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.0-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"keycloak-config-cli-iamguarded-compat","name":"keycloak-config-cli-iamguarded-compat","label":"keycloak-config-cli-iamguarded-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/keycloak-config-cli-iamguarded-compat","purlType":"apk","versions":[{"text":"< 6.5.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.5.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 4.3.1.1-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r11","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zipkin","name":"zipkin","label":"zipkin","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zipkin","purlType":"apk","versions":[{"text":"< 3.6.1-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.1-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"zipkin-slim","name":"zipkin-slim","label":"zipkin-slim","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/zipkin-slim","purlType":"apk","versions":[{"text":"< 3.6.1-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.1-r7","eol":null,"hubHref":null},{"vendor":"org.springframework.boot","product":"spring-boot","name":"org.springframework.boot:spring-boot","label":"spring-boot","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework.boot/spring-boot","purlType":"maven","versions":[{"text":"≥ 4.0.0, < 4.0.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.5.0, < 3.5.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.4.0, ≤ 3.4.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.3.0, ≤ 3.3.18","noFixRecorded":false,"fixedIn":null},{"text":"≤ 2.7.32","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.0.0, < 4.0.6 | ≥ 3.5.0, < 3.5.14 | ≥ 3.4.0, ≤ 3.4.15 | ≥ 3.3.0, ≤ 3.3.18 | ≤ 2.7.32","eol":{"isEol":null,"eolDate":null,"matchMethod":"purl","cycle":null,"product":{"name":"spring-boot","label":"Spring Boot","category":"framework"}},"hubHref":null},{"vendor":"spring","product":"spring boot","name":"Spring Boot","label":"spring boot","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.0.0, < 4.0.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.5.0, < 3.5.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.4.0, < 3.4.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.3.0, < 3.3.19","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.7.0, < 2.7.33","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.0.0, < 4.0.6 | ≥ 3.5.0, < 3.5.14 | ≥ 3.4.0, < 3.4.16 | ≥ 3.3.0, < 3.3.19 | ≥ 2.7.0, < 2.7.33","eol":null,"hubHref":"/vendor/spring/spring_boot"},{"vendor":"vmware","product":"spring_boot","name":"spring boot","label":"spring_boot","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.7.33","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.3.0, < 3.3.19","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.4.0, < 3.4.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.5.0, < 3.5.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.0.0, < 4.0.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.33 | ≥ 3.3.0, < 3.3.19 | ≥ 3.4.0, < 3.4.16 | ≥ 3.5.0, < 3.5.14 | ≥ 4.0.0, < 4.0.6","eol":null,"hubHref":"/vendor/vmware/spring_boot"}],"affectedCount":36,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://spring.io/security/cve-2026-40973","label":"spring.io/security/cve-2026-40973","hostname":"spring.io","tags":["WEB","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40973.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40973.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40973","label":"nvd.nist.gov/vuln/detail/CVE-2026-40973","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-boot","label":"github.com/spring-projects/spring-boot","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-Q9W2-5FVJ-M9FM"]},"timeline":[{"kind":"published","date":"2026-04-27T23:29:51.946Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-29T03:55:43.148Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T12:49:25.915Z","stale":false,"partial":false}}