CVE-2026-40974 is a TLS hostname verification gap in Spring Boot, scored CVSS 5.0. Cassandra SSL auto configuration connects without verifying the server hostname. Fixes are 4.0.6 and 3.5.14 for open source users, with older lines fixed only under enterprise support.
What's affected
From the Spring advisory dated 2026-04-23, rated medium:
- 4.0.0 through 4.0.5, fixed in 4.0.6 (open source)
- 3.5.0 through 3.5.13, fixed in 3.5.14 (open source)
- 3.4.0 through 3.4.15, fixed in 3.4.16 (enterprise support only)
- 3.3.0 through 3.3.18, fixed in 3.3.19 (enterprise support only)
- 2.7.32 and earlier, fixed in 2.7.33 (enterprise support only)
If you run a line that is out of open source support, the practical choice is to move to a supported line or take enterprise support. The advisory says no further mitigation steps are needed after the upgrade.
How to check if you're exposed
Find your Spring Boot version:
mvn dependency:tree -Dincludes=org.springframework.boot:spring-boot
./gradlew dependencies --configuration runtimeClasspath | grep spring-boot
Then see whether the application connects to Cassandra over SSL through Spring Boot auto configuration. Look for spring.cassandra and SSL settings in your configuration files.
What to do now
- Upgrade to 4.0.6 or 3.5.14 or later where you can.
- If you are on 3.4, 3.3 or 2.7, plan a move to a supported line, or obtain the enterprise fix.
- Inventory services that connect to Cassandra with SSL enabled.
- Confirm the version in the deployed artifact after rollout.
Why it matters
The weakness is CWE-295, improper certificate validation. Encryption without identity checks protects against passive listeners but not against a server that impersonates the host. For databases, that can mean sending queries and credentials to the wrong party.
Because the vector is adjacent network with high complexity, the score is medium. Do not read that as harmless for cloud and shared networks, where a path position is easier to obtain than in a locked down data center. The record does not flag exploitation in the wild.
Quick check
Do I need to change Cassandra certificates?
The advisory only calls for upgrading. Your certificates still need to match your hostnames once verification is on, so test before you roll out.
Sources
Last reviewed: 19 October 2026.
