This vulnerability is a timing attack that targets the remote secret comparison used by Spring Boot’s DevTools. An attacker who can communicate with the same network as the target application may measure response times to deduce bits of the secret. Once the secret is fully compromised, the attacker can upload malicious classes to the application and gain remote code execution. The weakness is defined by CWE‑208, a timing side‑channel vulnerability, and the impact ranges from inadvertent information disclosure to full remote compromise.

Spring Boot versions 4.0.0 through 4.0.5, 3.5.0 through 3.5.13, 3.4.0 through 3.4.15, 3.3.0 through 3.3.18, and 2.7.0 through 2.7.32 are affected. Fixes are available as 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33 respectively. Unsupported Spring Boot releases are also vulnerable according to the vendor advisory.

The CVSS score of 7.5 indicates a high severity. No EPSS data is currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local network attacker able to issue network requests to the remote application, leveraging timing differences to extract the secret. Successful exploitation would allow the attacker to upload arbitrary classes, achieving remote code execution on the host system.