CVE-2026-40974
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. This affects multiple Spring Boot versions including 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32.
Risk Assessment
Lack of hostname verification enables man-in-the-middle attacks, potentially leading to interception or modification of data between the application and Cassandra.
Recommendation
Update Spring Boot to a fixed version: 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33, depending on your line.
Original NVD description (English source)
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.