Timing attack in Spring Boot DevTools remote secret comparison

CVE-2026-40972 is a timing side-channel vulnerability in Spring Boot DevTools remote access. The flaw is in the spring-boot-devtools module, specifically the org.springframework.boot.devtools.remote.server.HttpHeaderAccessManager class, where the configured DevTools remote secret was compared against an attacker-supplied HTTP header using Java's non-constant-time String.equals(). Because String.equals() short-circuits on the first mismatched character, it leaks timing differences that can allow an adjacent-network attacker to infer the secret incrementally, character by character. If the attacker successfully reconstructs the remote secret, they can authenticate to the DevTools remote endpoint and use the live reload mechanism to upload changed class files. Affected versions are Spring Boot 4.0.0 through 4.0.5, 3.5.0 through 3.5.13, 3.4.0 through 3.4.15, 3.3.0 through 3.3.18, and 2.7.0 through 2.7.32; unsupported versions are also affected per the vendor advisory. The issue was fixed by replacing String.equals() with MessageDigest.isEqual(), storing the expected secret as a UTF-8 byte array, and adding a null check before converting the provided secret to bytes.