Spring fixes TLS hostname verification flaws and DevTools timing attack issue

Spring published advisories for four vulnerabilities affecting its ecosystem, including three flaws in auto-configuration for Elasticsearch, Cassandra, and RabbitMQ that can disable TLS hostname verification when an SSL bundle is used. The issues are tracked as CVE-2026-40970, CVE-2026-40974, and CVE-2026-40971, respectively, and could weaken certificate validation for connections to those backend services.

A fourth advisory, CVE-2026-40972, affects Spring DevTools and states that remote secret comparison is vulnerable to timing attacks. Together, the disclosures highlight risks in both transport security and authentication-related logic, with the TLS-related bugs potentially exposing applications to man-in-the-middle scenarios and the DevTools issue creating an avenue for attackers to infer secrets through response timing differences.