An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote se

Summary

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); DevTools remote secret comparison. Versions that are no longer supported are also affected per vendor advisory.

Timeline

1. Apr 27, 2026, 11:15 PM UTCCVE published
2. Apr 28, 2026, 12:00 AM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Apr 29, 2026, 3:55 AM UTCRecord last updated

Affected versions

• Spring Spring Boot

  From 4.0.0 · fixed in 4.0.6; From 3.5.0 · fixed in 3.5.14; From 3.4.0 · fixed in 3.4.16; From 3.3.0 · fixed in 3.3.19; From 2.7.0 · fixed in 2.7.33

• org.springframework.boot:spring-boot-devtoolsMaven

  From 4.0.0 · fixed in 4.0.6

• org.springframework.boot:spring-boot-devtoolsMaven

  From 3.5.0 · fixed in 3.5.14

• org.springframework.boot:spring-boot-devtoolsMaven

  From 3.4.0 · through 3.4.15

• org.springframework.boot:spring-boot-devtoolsMaven

  From 3.3.0 · through 3.3.18

• org.springframework.boot:spring-boot-devtoolsMaven

  through 2.7.32

References 1