Spring Boot : Use of Insufficiently Random Values Vulnerability - CVE-2026-40975 - Vulnerability Database

Spring Boot : Use of Insufficiently Random Values Vulnerability - CVE-2026-40975

Medium

Reference: CVE-2026-40975

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-40975

Title: Spring Boot : Use of Insufficiently Random Values Vulnerability

Overview:

Values produced by random.value are not suitable for use as secrets. random.uuid is not affected. random.int and random.long should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.04.0.5 (fix 4.0.6) 3.5.03.5.13 (fix 3.5.14) 3.4.03.4.15 (fix 3.4.16) 3.3.03.3.18 (fix 3.3.19) 2.7.02.7.32 (fix 2.7.33) random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor