52 upstream CVEs landed across Tomcat, Netty, Jackson, and Jolokia this month, the largest batch this series has covered. Most of them are invisible to dependency scanners right now. Which Boot version you run determines which fixes reach you.

13 upstream CVEs landed across Netty, Tomcat, Logback, pgjdbc, and Jackson this month, with three of them High-severity. Which Boot version you run determines which fixes reach you.

18 upstream CVEs landed in a single Netty release this month, and every one of them is reachable through the Spring Boot managed-dependency BOM on EOL lines that pin Netty 4.1.

24 upstream CVEs landed across Tomcat, Netty, Thymeleaf, Jetty, and pgjdbc in a single month — every one reachable through the Spring Boot managed-dependency BOM on at least one EOL line.

A pre-auth path traversal in spring-cloud-config-server lets unauthenticated attackers read arbitrary files on the host. Affects 3.1.x through 5.0.x, with no upstream fix for EOL branches.

HeroDevs releases a drop-in replacement for Log4j 2.17.x patching two TLS hostname verification bypasses and three log pipeline vulnerabilities with no upstream fix available.