Skip to content

fix(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.4 [security]#182

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-main/maven-org.springframework.boot-spring-boot-starter-actuator-vulnerability
Open

fix(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.4 [security]#182
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-main/maven-org.springframework.boot-spring-boot-starter-actuator-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 31, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.springframework.boot:spring-boot-starter-actuator (source) 4.0.3 → 4.0.4 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Spring Boot has an Authentication Bypass under Actuator Health groups paths

CVE-2026-22731 / GHSA-8hfc-fq58-r658

More information

Details

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

CVE-2026-22733 / GHSA-mgvc-8q2h-5pgc

More information

Details

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Boot has an Authentication Bypass under Actuator Health groups paths

CVE-2026-22731 / GHSA-8hfc-fq58-r658

More information

Details

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

CVE-2026-22733 / GHSA-mgvc-8q2h-5pgc

More information

Details

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-actuator)

v4.0.4

Compare Source

⚠️ Attention Required
  • OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2. #​49453
  • Jackson 2 has been upgraded to 2.21.1 in response to the Jackson team ending support for Jackson 2.20.x. #​49389
  • Jackson has been upgraded to 3.1.0 in response to the Jackson team ending support for Jackson 3.0.x. #​49383
  • The default value for server.tomcat.max-part-count has been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #​49311
🐞 Bug Fixes
  • EndpointRequest request matcher for health groups is too complex #​49649
  • "/cloudfoundryapplication" web path is not limited to Actuator #​49646
  • Fix EndpointRequest.toLinks() when base-path is '/' #​49617
  • Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #​49596
  • RSocket exposes duplicate endpoint for websocket setups #​49593
  • Failure analysis for a missing mail sender is misleading #​49582
  • SpringBootContextLoader mentions class that no longer exists in message for classes or locations assertion #​49535
  • Ordering of 'spring.config.import' is inconsistent when defined in environment or system properties #​49482
  • "spring.main.cloud-platform=none" does not disable cloud features #​49479
  • SSL support with Docker Compose does not work as documented #​49385
  • Auto-configuration overrides authorization server configuration applied by Customizer beans #​49367
  • Using @AutoConfigureWebTestClient prevents separate configuration of spring.test.webtestclient.timeout from taking effect #​49344
  • NoSuchMethodException when forcing the use of Log4J2LoggingSystem using org.springframework.boot.logging.LoggingSystem system property #​49343
  • RouterFunctions descriptions in Actuator do not support nesting #​49302
  • Maven plugin does not set '-parameters' option when processing AOT code #​49295
  • HTTP Service Interface Client doesn't work in a native image due to missing property binding #​49274
  • ErrorPageRegistrarBeanPostProcessor is not auto-configured in war deployments and the ErrorPageCustomizer is not applied #​49176
  • Missing starter for spring-boot-restdocs #​48289
📔 Documentation
  • Document support for Java 26 #​49604
  • List all supported colors when describing color-coded log output #​49562
  • Improve EndpointRequest matcher documentation #​49520
  • Clarify that running is the only supported input state when triggering a Quartz job through the Actuator endpoint #​49514
  • Document security considerations for forwarded headers in cloud deployments #​49507
  • Tutorial in the reference guide has outdated instructions #​49429
  • Document additional repositories required for shibboleth.net #​49392
  • Javadoc of JettyHttpClientBuilder refers to the wrong type #​49387
  • Example spring-devtools.properties file is shown in the wrong format #​49362
  • Clarify inferred relationships between OAuth 2 registrations and providers #​49327
  • Mention using org.springframework.boot.aot Gradle plugin directly for AOT processing with the JVM #​49321
  • Remove superfluous semi-colon from read timeout configuration example for HTTP service interface clients #​49306
  • Update CLI's INSTALL.txt to reflect Groovy no longer being bundled #​49298
  • JDK requirement for the CLI still refers to Java 8 #​49293
  • Java and Kotlin samples of an environment post processor are inconsistent #​49287
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​FBibonne, @​answndud, @​bbbbooo, @​chandanv89, @​giyeon95, @​itsmevichu, @​jayychoi, @​l2yujw, @​ngocnhan-tran1996, @​qnnn, @​quaff, and @​sbrannen

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from lis0x90 as a code owner March 31, 2026 21:54
@renovate renovate Bot added the security label Mar 31, 2026
@renovate renovate Bot requested a review from ArkuNC March 31, 2026 21:54
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Mar 31, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate Bot changed the title chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.5 [security] chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.5 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot deleted the renovate-main/maven-org.springframework.boot-spring-boot-starter-actuator-vulnerability branch April 27, 2026 17:37
@github-actions github-actions Bot locked and limited conversation to collaborators Apr 27, 2026
@renovate renovate Bot changed the title chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.5 [security] - autoclosed chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.5 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate-main/maven-org.springframework.boot-spring-boot-starter-actuator-vulnerability branch 3 times, most recently from 40b5e9e to 953f6df Compare April 29, 2026 09:34
@renovate renovate Bot changed the title chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.5 [security] chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.6 [security] Apr 29, 2026
@renovate renovate Bot changed the title chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.6 [security] fix(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4.0.4 [security] May 22, 2026
@renovate renovate Bot force-pushed the renovate-main/maven-org.springframework.boot-spring-boot-starter-actuator-vulnerability branch from 953f6df to b8a5f73 Compare May 22, 2026 03:47
@github-actions github-actions Bot added the bug Something isn't working label May 22, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@lis0x90 lis0x90 Awaiting requested review from lis0x90 lis0x90 is a code owner

@ArkuNC ArkuNC Awaiting requested review from ArkuNC

Assignees

@lis0x90 lis0x90

@ArkuNC ArkuNC

Labels

branch:main bug Something isn't working renovate:core security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lis0x90 @ArkuNC