Spring Boot's Elasticsearch auto‑configuration, when set to use an SSL bundle, omits hostname verification when establishing a TLS connection to the Elasticsearch server. Without this check, an attacker could present a certificate for any hostname, leading a Spring Boot application to trust the connection and potentially intercept or modify traffic. The vulnerability does not provide direct code execution but can compromise confidentiality and integrity of data exchanged with Elasticsearch.

Vendors and products affected are Spring and Spring Boot. The vulnerable range covers Spring Boot 4.0.0 through 4.0.5. The vendor advisory recommends upgrading to Spring Boot 4.0.6 or later.

The CVSS score of 5 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a network‑level adversary who can introduce a malicious Elasticsearch server or intercept traffic between the Spring Boot application and Elasticsearch. Exacerbated conditions include environments that do not enforce hostname verification in TLS. While exploitation is feasible when the application can reach an attacker‑controlled Elasticsearch endpoint, the absence of a publicly available exploit reduces immediate risk but warrants timely remediation.