Spring Boot 2.74.0.6 ApplicationPidFileWriter PID File Corruption
CVE-2026-40977 Published on April 27, 2026
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.04.0.5 (fix 4.0.6), 3.5.03.5.13 (fix 3.5.14), 3.4.03.4.15 (fix 3.4.16), 3.3.03.3.18 (fix 3.3.19), 2.7.02.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.
Vulnerability Analysis
CVE-2026-40977 can be exploited with local system access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and a high impact on availability.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-40977 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-40977
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Boot:- Version 4.0.0 and below 4.0.6 is affected.
- Version 3.5.0 and below 3.5.14 is affected.
- Version 3.4.0 and below 3.4.16 is affected.
- Version 3.3.0 and below 3.3.19 is affected.
- Version 2.7.0 and below 2.7.33 is affected.