Spring Boot’s mail auto‑configuration fails to enable SSL hostname verification when the application relies on defaults. As a result, a malicious SMTP server can present a forged certificate and the client will accept it, allowing the attacker to intercept or modify email traffic and potentially harvest credentials or other sensitive data. The weakness is a lack of an integrity check for the server identity, which can lead to data confidentiality and authentication failures.

Spring Boot versions 4.0.0 through 4.0.6, 3.5.0 through 3.5.14, and 3.4.0 through 3.4.16 are affected. Upstream five minors before 4.0.7, 3.5.15, and 3.4.17 contain the fix and should be used if possible.

The CVSS score of 5 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker who can control or spoof the SMTP server the application connects to; the effort to exploit is low as no privileged access or code execution is required. Proper mitigation removes the ability for an attacker to perform a man‑in‑the‑middle attack against the client’s email transport.