Back spring.io CVE-2026-40972: DevTools remote secret comparison is vulnerable to timing attacks
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.
Versions that are no longer supported are also affected.
Users of affected versions should upgrade to the corresponding fixed version.
No further mitigation steps are necessary.
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Check out all the upcoming events in the Spring community.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
