Impact of CVE-2026-40992 on Spring Boot 2.7

Products

• VMware Tanzu Platform Core

Issue/Introduction

Security scanners or the official Spring Security advisory may identify CVE-2026-40992 as a potential vulnerability. Customers utilizing Spring Boot 2.7.x have requested clarification on whether this branch is affected and why no recent patches have been released for this line.

Symptoms

• Security audits flagging CVE-2026-40992 for applications running on Spring Boot 2.7.
• Inquiries regarding the lack of new 2.7.x releases since Nov. 2023.

Cause

CVE-2026-40992 is related to an information disclosure vulnerability specifically within the SSL support for JavaMail (mail sender).

Investigation by the Spring engineering team has confirmed that this vulnerability does not apply to the Spring Boot 2.7 branch for the following reasons:

1. Feature Absence: The vulnerable code path—specifically the native SSL support for the mail sender—was not introduced until Spring Boot 3.4.
2. Version Logic: Because the feature does not exist in version 2.7.x, the vulnerability cannot be triggered.

Resolution

Spring Boot 2.7.x is NOT affected by CVE-2026-40992. No action is required to mitigate this specific CVE for applications on the 2.7.x line.

Support and Patching Status

• OSS Support: Open Source support for Spring Boot 2.7 ended in Nov. 2023. This is why no new public versions have been released since that time.
• Commercial Support: Spring Boot 2.7 remains under Commercial Support (eligible for Tanzu Spring Runtime customers). While the branch is supported, patches are only developed for vulnerabilities that actually impact the code base. Since CVE-2026-40992 does not affect 2.7.x, no backport or patch is necessary.