Executive Summary

CVE-2026-40975 is a security vulnerability in certain versions of Spring Boot where the random value property source uses a weak pseudorandom number generator (PRNG) that is not suitable for generating secrets.

Specifically, values produced by the `${random.value}` expression are insecure for secret generation. The `${random.uuid}` expression is not affected by this issue.

Additionally, `${random.int}` and `${random.long}` should never be used for secrets because they produce numeric values within predictable ranges, making them insecure.

The affected Spring Boot versions include 2.7.0 through 2.7.32, 3.3.0 through 3.3.18, 3.4.0 through 3.4.15, 3.5.0 through 3.5.13, and 4.0.0 through 4.0.5, including unsupported versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves the use of weak pseudorandom number generators (PRNG) in certain Spring Boot versions for generating secrets, which can lead to predictable secret values.

Using insecure secrets can potentially weaken the security of systems that rely on these secrets for authentication, encryption, or data protection.

Such weaknesses may impact compliance with standards and regulations like GDPR and HIPAA, which require appropriate measures to protect sensitive data and ensure confidentiality and integrity.

However, the provided information does not explicitly describe the direct impact on compliance or specific regulatory requirements.

Mitigation involves upgrading to fixed versions of Spring Boot where the issue is resolved.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to the use of weak pseudorandom number generators in certain versions of Spring Boot when generating secrets using the ${random.value} property source.

Detection involves identifying if your system is running an affected version of Spring Boot (versions 2.7.0 through 2.7.32, 3.3.0 through 3.3.18, 3.4.0 through 3.4.15, 3.5.0 through 3.5.13, or 4.0.0 through 4.0.5) and if the application uses ${random.value} or other insecure random expressions for secret generation.

There are no specific network detection commands provided in the resources. However, you can check your Spring Boot application version by running commands such as:

• For Maven projects: mvn dependency:list | grep spring-boot
• For Gradle projects: ./gradlew dependencies --configuration runtimeClasspath | grep spring-boot

To detect usage of the vulnerable random expressions in your codebase, you can search for the strings '${random.value}', '${random.int}', or '${random.long}' in your configuration files or source code using commands like:

• grep -r '\${random.value}' ./
• grep -r '\${random.int}' ./
• grep -r '\${random.long}' ./

If these expressions are found and the Spring Boot version is affected, the system is vulnerable and should be upgraded to a fixed version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing secrets generated using `${random.value}`, `${random.int}`, or `${random.long}` to be weak and predictable.

Weak secrets can lead to security risks such as unauthorized access, data exposure, or compromise of systems relying on these secrets for authentication or encryption.

Since the vulnerability involves a weak pseudorandom number generator, attackers might predict or reproduce secret values, undermining the security of applications using affected Spring Boot versions.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade your Spring Boot version to a fixed release where the issue is resolved.

• Upgrade to Spring Boot 4.0.6 or later if using 4.0.x versions.
• Upgrade to Spring Boot 3.5.14 or later if using 3.5.x versions.
• Upgrade to Spring Boot 3.4.16 or later if using 3.4.x versions (Enterprise Support Only).
• Upgrade to Spring Boot 3.3.19 or later if using 3.3.x versions (Enterprise Support Only).
• Upgrade to Spring Boot 2.7.33 or later if using 2.7.x versions (Enterprise Support Only).

No additional mitigation steps are required beyond upgrading.

Useful 0 Not Useful 0