When an application is configured to use , a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 28, 2026 · NIST NVD

   Detected

   When an application is configured to use , a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior ( ). Versions that are no longer supporte

2. Jul 24, 2026 · NIST NVD

   Updated

   When an application is configured to use , a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior ( ). Versions that are no longer supporte

Affected

• cpe vmware/spring bootversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-40977

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-40977

  When an application is configured to use , a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4

  nvd.nist.gov

References

• Vendor Advisory · spring.io