Loading vulnerability…
Missing TLS hostname verification in Spring Boot Mail auto-configuration
Spring Boot Mail auto-configuration does not enable SSL/TLS hostname verification, allowing a mail connection to accept a server certificate without verifying that its identity matches the intended server hostname. Affected versions include 4.0.0–4.0.6, 3.5.0–3.5.14, and 3.4.0–3.4.16; unsupported versions are also affected. This weakness can enable mail-server impersonation and man-in-the-middle attacks. Applications that explicitly enable the relevant JavaMail server-identity verification property are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to intercept or redirect affected mail connections could impersonate the intended mail server, potentially exposing transmitted messages and authentication credentials or allowing manipulation or disruption of mail delivery. Missing hostname verification does not itself disable other certificate-validation checks.
If you can’t patch tonight, do this now.
Explicitly enable JavaMail SSL/TLS hostname verification. For SMTP, set spring.mail.properties.mail.smtp.ssl.checkserveridentity=true. Use the corresponding server-identity verification property for other configured mail protocols. No additional mitigation is required after upgrading to a fixed release.
Patch, then assume compromise.
Upgrade Spring Boot and its managed mail dependencies to the corresponding fixed release: 4.0.7 or later in the 4.0.x branch, or 3.5.15 or later in the 3.5.x branch. Enterprise Support fixes are available in 4.0.6.1, 3.5.14.1, and 3.4.17. Deployments on unsupported branches should migrate to a supported fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.