Back spring.io

CVE-2026-40973: Predictable temp directory accepted without ownership verification

spring.io • April 27, 2026

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp . When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.

Versions that are no longer supported are also affected.

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Check out all the upcoming events in the Spring community.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting Spring Framework Released on April 27, 2026 On April 27, 2026, three critical vulnerabilities were disclosed for the Spring Framework. CVE-2026-40973 allows local attackers to hijack sessions by exploiting predictable temp directory permissions. CVE-2026-40972 enables remote attackers on the same network to execute code via timing attacks on remote secrets. CVE-2026-40976 reveals ineffective default web security, permitting unauthorized access to endpoints. All affected versions, including those no longer supported, require immediate upgrades to fixed versions. No further mitigation steps are necessary for users. The vulnerabilities pose significant risks to applications using the Spring Framework, especially in multi-user environments. Users are urged to act promptly to secure their applications. 4 sources 72

Extracted Entities

CVE-2026-40973: Predictable temp directory accepted without ownership verification

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (3)