maven package report

Is org.springframework.boot:spring-boot-devtools safe?

1 known vulnerability, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

0.30%

chance of exploitation in the next 30 days

xyz score

3.3

CyberXYZ composite, out of 10

fig. 01 — GHSA-56v8-86gj-66jp, the advisory selected below

// advisories

GHSA-56v8-86gj-66jp

HIGHCVE-2026-40972

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code execution in the remote application.

Affected: >= 4.0.0, < 4.0.6
Fixed in: 4.0.6
Weakness: CWE-208
Published: 2026-04-28
Source: github

GHSA NVD MITRE reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 02:32 UTC. The most recent advisory here was published 2026-04-28. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is org.springframework.boot:spring-boot-devtools safe? maven package security report | CyberXYZ