Package Health/org.springframework.boot:spring-boot-cassandra

spring-boot-cassandra

Spring Boot Cassandra

Latest 4.2.0-M2org.springframework.boot

Maven

78%

Total Score

healthy

Healthy overall, backed by active development and signed provenance; this milestone release has some workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Repo package mention

The repository name does not match the package and its README does not mention the package, which creates some package-to-source ambiguity. The organization-owned Spring Boot monorepo context partly offsets this concern.

Version stability

4.2.0-M2 is a prerelease, and 45% of recent releases are prereleases, so APIs and behavior may still change. The stable major line and active release cadence partly compensate for that risk.

Workflow audit

All 10 workflows were analyzed and use read-only permissions, with no untrusted checkouts or script injections. However, the audit reports 10 high-confidence template-injection findings and 3 of 28 action references are unpinned, so workflow hygiene warrants caution.

Vulnerabilities

Title	Versions	Severity
CVE-2026-40977 org.springframework.boot:spring-boot-cassandra is vulnerable to Improper Link Resolution Before File Access ('Link Following') in versions 4.0.0 - 4.0.6, 3.5.0 - 3.5.14, 3.4.0 - 3.4.15, 3.3.0 - 3.3.18 and 0.0.0 - 2.7.32.	0.0.0 - 2.7.323.3.0 - 3.3.183.4.0 - 3.4.15 +2 more	Medium
CVE-2026-40975 org.springframework.boot:spring-boot-cassandra is vulnerable to Use of Insufficiently Random Values in versions 4.0.0 - 4.0.6, 3.5.0 - 3.5.14, 3.4.0 - 3.4.15, 3.3.0 - 3.3.18 and 0.0.0 - 2.7.32.	0.0.0 - 2.7.323.3.0 - 3.3.183.4.0 - 3.4.15 +2 more	Medium
AIKIDO-2026-10584 spring-boot-cassandra is vulnerable to Improper Certificate Validation in versions 2.7.0 - 3.5.13 and 4.0.0 - 4.0.5.	2.7.0 - 3.5.134.0.0 - 4.0.5	Medium