Product

org.springframework.boot/spring-boot-elasticsearch vulnerabilities

1 published CVE affecting org.springframework.boot/spring-boot-elasticsearch, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Latest org.springframework.boot/spring-boot-elasticsearch CVEs

Newest publication first

CVE-2026-40970 Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.
Published 2026-04-27

MediumCVSS 6.8 EPSS 0.14%

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

org.springframework.boot/spring-boot-elasticsearch vulnerabilities

Latest org.springframework.boot/spring-boot-elasticsearch CVEs

CVE-2026-40970 Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.