When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can…

Description

When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior (`ApplicationPidFileWriter`). Versions that are no longer supported are also affected per vendor advisory.

Scores

EPSS (exploitation in 30 days)

0.11% · top 99% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.7.

Weakness

• CWE-59: Improper Link Resolution Before File Access (opens in a new tab)All about CWE-59 and its CVEs

Affected products

• Spring · Spring Boot

  • affected 4.0.0 – < 4.0.6
  • affected 3.5.0 – < 3.5.14
  • affected 3.4.0 – < 3.4.16
  • affected 3.3.0 – < 3.3.19
  • affected 2.7.0 – < 2.7.33

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.springframework.boot:spring-boot-cassandraGHSA-5368-6h4h-gr29 (opens in a new tab)

References (1)

• https://spring.io/security/cve-2026-40977 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-5368-6h4h-gr29 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-40977](https://trackcve.app/badge/CVE-2026-40977.svg)](https://trackcve.app/cve/CVE-2026-40977)

Record last updated 28 Apr 2026, 14:34 UTC.