Pink arrow right
Back to all posts
Erik Weibust
Erik Weibust
Senior Engineering Manager
. . .
Spring Boot Managed Dependencies Still Get CVEs After EOL: May 2026 Patch Round-Up
Security
May 15, 2026
Spring Boot Managed Dependencies Still Get CVEs After EOL: May 2026 Patch Round-Up
24 upstream CVEs landed across Tomcat, Netty, Thymeleaf, Jetty, and pgjdbc in a single month — every one reachable through the Spring Boot managed-dependency BOM on at least one EOL line.
CVE-2026-40982: Critical Spring Cloud Config Server Directory Traversal (CVSS 9.8)
Security
May 8, 2026
CVE-2026-40982: Critical Spring Cloud Config Server Directory Traversal (CVSS 9.8)
A pre-auth path traversal in spring-cloud-config-server lets unauthenticated attackers read arbitrary files on the host. Affects 3.1.x through 5.0.x, with no upstream fix for EOL branches.
Log4j 2.17.x: Five Unpatched CVEs Now Resolved with NES for Apache Log4j 2
Security
May 7, 2026
Log4j 2.17.x: Five Unpatched CVEs Now Resolved with NES for Apache Log4j 2
HeroDevs releases a drop-in replacement for Log4j 2.17.x patching two TLS hostname verification bypasses and three log pipeline vulnerabilities with no upstream fix available.