Loading vulnerability…
Spring Boot DevTools Remote Secret Timing Attack Leading to RCE
CVE-2026-40972 is a timing side-channel vulnerability in Spring Boot DevTools remote authentication. HttpHeaderAccessManager compares the configured remote secret with a user-supplied HTTP header using Java String.equals(), a non-constant-time comparison that can expose timing differences. An adjacent-network attacker may use repeated measurements to infer information about the secret. In extreme circumstances, recovering the complete secret allows the attacker to authenticate to remote DevTools and upload modified classes, resulting in remote code execution. Affected Spring Boot versions include 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32; unsupported versions are also affected. Applications without deployed DevTools or without remote DevTools enabled are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The immediate impact is disclosure of information about the DevTools remote secret through observable response timing. Complete secret recovery can allow an attacker to authenticate to the remote development interface and upload malicious classes for execution in the application. Successful exploitation can compromise application confidentiality, integrity, and availability. Remote code execution is a conditional outcome requiring successful secret reconstruction, not an automatic consequence of endpoint exposure.
If you can’t patch tonight, do this now.
If immediate upgrading is not possible, disable remote DevTools by removing the spring.devtools.remote.secret configuration, or exclude DevTools from deployed application artifacts. Restrict network access to the remote DevTools interface to trusted development clients as defense in depth; network restrictions do not correct the timing flaw.
Patch, then assume compromise.
Upgrade Spring Boot and spring-boot-devtools to the fixed release for the deployed branch: 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33, or a subsequent fixed release. Fixes for 3.4.16, 3.3.19, and 2.7.33 are available through Spring Enterprise Support. Migrate unsupported versions to a supported, fixed release. The patch replaces String.equals() with MessageDigest.isEqual() and stores the expected secret as UTF-8 bytes for constant-time comparison.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.