Insecure Mail Configuration in Spring Boot Affects Security

CVE-2026-40992

What is CVE-2026-40992?

The vulnerability in Spring Boot arises from the Mail auto-configuration failing to enforce hostname verification, which can expose applications to potential man-in-the-middle attacks. If users do not set the appropriate JavaMail property (spring.mail.properties.mail.smtp.ssl.checkserveridentity=true), their applications may transmit sensitive data to unverified hosts, leading to significant security risks.

References