CVE-2026-40974: Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

April 28, 2026 (updated May 6, 2026)

Spring Boot’s Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.

References

github.com/advisories/GHSA-mqvw-jfmh-93qq
nvd.nist.gov/vuln/detail/CVE-2026-40974
spring.io/security/cve-2026-40974

Code Behaviors & Features

Detect and mitigate CVE-2026-40974 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →