Pink arrow right
Back to all posts
Erik Weibust
Erik Weibust
Senior Engineering Manager
. . .
Spring Boot Managed Dependencies Still Get CVEs After EOL: July 2026 Patch Round-Up
Security
Jul 21, 2026
Spring Boot Managed Dependencies Still Get CVEs After EOL: July 2026 Patch Round-Up
13 upstream CVEs landed across Netty, Tomcat, Logback, pgjdbc, and Jackson this month, with three of them High-severity. Which Boot version you run determines which fixes reach you.
Spring Boot Managed Dependencies Still Get CVEs After EOL: June 2026 Patch Round-Up
Security
Jul 20, 2026
Spring Boot Managed Dependencies Still Get CVEs After EOL: June 2026 Patch Round-Up
18 upstream CVEs landed in a single Netty release this month, and every one of them is reachable through the Spring Boot managed-dependency BOM on EOL lines that pin Netty 4.1.
Spring Boot Managed Dependencies Still Get CVEs After EOL: May 2026 Patch Round-Up
EOL Software
May 15, 2026
Spring Boot Managed Dependencies Still Get CVEs After EOL: May 2026 Patch Round-Up
24 upstream CVEs landed across Tomcat, Netty, Thymeleaf, Jetty, and pgjdbc in a single month — every one reachable through the Spring Boot managed-dependency BOM on at least one EOL line.
CVE-2026-40982: Critical Spring Cloud Config Server Directory Traversal (CVSS 9.1)
Security
May 8, 2026
CVE-2026-40982: Critical Spring Cloud Config Server Directory Traversal (CVSS 9.1)
A pre-auth path traversal in spring-cloud-config-server lets unauthenticated attackers read arbitrary files on the host. Affects 3.1.x through 5.0.x, with no upstream fix for EOL branches.
Log4j 2.17.x: Five Unpatched CVEs Now Resolved with NES for Apache Log4j 2
Security
May 7, 2026
Log4j 2.17.x: Five Unpatched CVEs Now Resolved with NES for Apache Log4j 2
HeroDevs releases a drop-in replacement for Log4j 2.17.x patching two TLS hostname verification bypasses and three log pipeline vulnerabilities with no upstream fix available.