AIKIDO-2026-10583
spring-boot is vulnerable to Insecure Randomness
60
Medium Risk
This Affects:
spring-bootTL;DR
Affected versions of this package are vulnerable to the use of a weak pseudo-random number generator in the random value property source, causing ${random.value} to generate values unsuitable for use as secrets. Predictable or low-entropy values may weaken tokens, passwords, or other security-sensitive data derived from these properties.
Who does this affect?
You are affected if using a vulnerable version.
Background info
spring-boot is vulnerable to Insecure Randomness in versions 2.7.0 - 2.7.32, 3.3.0 - 3.3.18, 3.4.0 - 3.4.15, 3.5.0 - 3.5.13 and 4.0.0 - 4.0.5.
How to fix this
Upgrade the org.springframework.boot:spring-boot library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant