CVE-2026-40992: Spring Boot Mail Auto-Configuration Missing Hostname Verification

Technical summary

CVE-2026-40992 stems from Spring Boot's mail auto-configuration failing to enable hostname verification (CWE-295) for SMTP connections. The vulnerability affects Spring Boot versions 4.0.0–4.0.6, 3.5.0–3.5.14, and 3.4.0–3.4.16. When applications initialize mail properties without explicit configuration of the mail.smtp.ssl.checkserveridentity property, SMTP connections do not validate that the server certificate matches the target hostname. This creates an opening for network-based attackers to present forged certificates during TLS handshakes. Applications that set spring.mail.properties.mail.smtp.ssl.checkserveridentity=true in their configuration escape this issue entirely.

Business impact

Organizations using affected Spring Boot versions may unknowingly expose email traffic to interception and tampering. While the CVSS score of 5.0 indicates moderate severity, the real risk depends on deployment context: applications sending sensitive data via email (credentials, password resets, transaction confirmations) face elevated exposure. Attackers could read, modify, or suppress email messages, potentially compromising account security, data integrity, or business continuity. The risk is particularly acute in environments with untrusted network access, such as shared cloud infrastructure or compromised network segments.

Affected systems

Spring Boot 4.0.0 through 4.0.6, 3.5.0 through 3.5.14, and 3.4.0 through 3.4.16 are in scope. Any application built on these versions that uses Spring's mail auto-configuration and does not explicitly set the mail.smtp.ssl.checkserveridentity property is vulnerable. Applications already configuring the JavaMail property directly are not affected. Applications using older Spring Boot versions (before 3.4.0) or those that have upgraded beyond the affected ranges are outside the vulnerability window.

Exploitability

Exploitation requires network access to the communication path between the application and its mail server (AV:A in the CVSS vector). An attacker must also overcome the complexity of obtaining or generating a forged certificate that the client will accept, reflected in the AC:H (High Complexity) rating. No user interaction or elevated privileges are needed. In practice, this means exploitation is feasible primarily in network environments where the attacker has position (e.g., ARP spoofing, BGP hijacking, or compromised network infrastructure) and where Certificate Pinning or similar defenses are not in place. The vulnerability is not known to be actively exploited in the wild (KEV status: false).

Remediation

Upgrade to patched versions of Spring Boot: use 4.0.7 or later for the 4.0 line, 3.5.15 or later for the 3.5 line, or 3.4.17 or later for the 3.4 line. Verify against the official Spring Boot release notes for exact patch availability. Alternatively, immediately add the configuration property spring.mail.properties.mail.smtp.ssl.checkserveridentity=true to your application's properties file (application.properties or application.yml) to enable hostname verification without waiting for a patch. This property can be set independently of the Spring Boot version and will override the auto-configuration default.

Patch guidance

Patched versions are Spring Boot 4.0.7+, 3.5.15+, and 3.4.17+. Test patches in a staging environment before deployment to ensure mail functionality remains intact and no application-level configurations conflict with the corrected defaults. If immediate patching is not feasible, implement the workaround property configuration in all environments to reduce exposure. Monitor release notes from the Spring team for any additional security updates related to mail configuration.

Detection guidance

Review application configuration files and logs for evidence of the vulnerability. Check whether spring.mail.properties.mail.smtp.ssl.checkserveridentity is explicitly set to true; if absent or false, the application is vulnerable (unless already patched). Inspect Spring Boot version metadata in your build artifacts and dependency trees to identify which projects are running affected releases. Monitor outbound SMTP traffic for certificate validation errors in application logs—the absence of SSL/TLS handshake failures in mail operations may indicate that verification was never enforced. Test SMTP connectivity with intentionally misconfigured mail servers or man-in-the-middle proxies in controlled environments to confirm whether certificate validation occurs.

Why prioritize this

Although CVSS 5.0 is classified as MEDIUM, prioritization should account for deployment specifics. Rank this vulnerability higher if: (1) your applications handle sensitive email communications (authentication tokens, financial transactions); (2) network architecture includes untrusted segments or shared infrastructure; (3) TLS/mTLS is not universally enforced between application servers and mail infrastructure. Rank lower if: (1) mail servers are on isolated, trusted networks; (2) application email is non-sensitive (notifications only); (3) you have already applied patches or the workaround property. The lack of KEV (Known Exploited Vulnerability) status suggests limited real-world weaponization, but this does not diminish the importance of remediation in high-risk environments.

Risk score, explained

CVSS 3.1 score of 5.0 (MEDIUM) reflects limited attack surface (AV:A, network access only), moderate attack complexity (AC:H, attacker must forge certificates and position on network path), and impact scope (C:L, I:L, A:L—low confidentiality, integrity, and availability impact per connection). The score does not fully capture the business risk of email tampering or the concentrating effect in high-value communication channels. Use this as a baseline; adjust severity upward in your risk model if mail is a critical security control (e.g., authentication channels, audit logs) or if your network environment has a history of insider threats or advanced persistent threats.

Frequently asked questions