Spring Boot Managed Dependencies Still Get CVEs After EOL: September 2026 Patch Round-Up

The Dependency-Management Problem for EOL Spring Boot

We covered the mechanics in May. Short version: Spring Boot pins specific versions of Tomcat, Netty, Jackson, Logback, and dozens more through its spring-boot-dependencies BOM. On a maintained Boot line those pins advance. On an EOL Boot line they freeze. Upstream projects keep shipping CVEs, and none of that reaches the frozen BOM.

‍

September is the heaviest month since this series started. May was 24 CVEs. July was 13. September is 52 distinct runtime CVEs, and two things make it different from the earlier rounds.

‍

First, the volume is concentrated in the two dependencies every Boot line carries. Tomcat shipped two security batches in a row (10.1.59 and 10.1.60 on the 10.1 line, 9.0.122 on the 9.0 line), and Netty published 23 security advisories against 4.1.137 in a single release. Between them that is 47 CVEs that reach every EOL Boot version from 2.5 through 3.5, regardless of which libraries the BOM pins beyond those two.

‍

Second, and this is the part worth reading twice: most of these fixes did not show up in scanner output when the release shipped. As of September 24, 2026, OSV and the GitHub Advisory Database had no machine-readable package range for any of the 23 Netty advisories or for 20 of the 23 Tomcat CVEs, and the Jackson advisories were only starting to pick up affected-range data. A dependency scanner pointed at Netty 4.1.137 or Tomcat 9.0.121 on that date reported them clean. That window will close as the databases catch up, but the upstream release notes and advisories were the source of truth this month, and the scanners were weeks behind them.

‍

The frozen BOM on an EOL Boot version was already a problem when scanners could see the gap. It is a bigger problem when they cannot.

‍

What Was Patched in September 2026

The September 2026 NES Spring Boot release picks up 52 unique upstream runtime CVEs across four managed dependencies, plus one build-time fix and three hardening bumps that carry no CVE at all. By vendor rating: zero Critical, 23 High or Important, 17 Medium or Moderate, and 12 Low. CISA-ADP disagrees with Apache on several of the Tomcat records and scores seven of them Critical (CVSS 9.1 to 9.8); both ratings are shown in the appendix.

Four items are worth calling out specifically because they change actual security posture rather than availability.

‍

CVE-2026-76183 is a security-constraint bypass for WebSocket endpoints in Apache Tomcat. Request paths that parse as Jakarta WebSocket endpoint templates slip past the container's <security-constraint> checks, so a WebSocket endpoint that was supposed to sit behind container-managed auth does not. Apache rates it Important; CISA-ADP scores it 9.8. Fixed in 10.1.60 and 9.0.122. This lands on every EOL Boot version that embeds Tomcat, which is all of them, and it is the highest-severity item in the round.

‍

CVE-2026-86350 is a regression in the fix for CVE-2026-41293 that lets HTTP/2 request headers cross between requests. One user's request can pick up another user's headers. It only affects Tomcat 10.1.55 through 10.1.59 and 9.0.118 through 9.0.121, which means the July NES release put every Boot line squarely inside the affected range, and it only matters with HTTP/2 enabled. Important, ADP 9.1. Fixed in 10.1.60 and 9.0.122. This is what an incomplete upstream fix looks like from the downstream side: the fix you shipped two months ago is the thing that now needs patching.

‍

The Netty HTTP/1.1 request-smuggling set is five advisories, not one. CVE-2026-93491 is an unbounded queue in HttpServerCodec under HTTP/1.1 pipelining (High). CVE-2026-89044 (also tracked as CVE-2026-93562), CVE-2026-93573, CVE-2026-93566, and CVE-2026-93574 are four separate Transfer-Encoding and chunk-size parsing gaps that each allow request smuggling (Medium, CVSS 6.5 each). All five reach any Netty HTTP/1.1 server, and in the Spring world that means every Reactor Netty server, so every WebFlux application on every EOL Boot version. Behind a reverse proxy, request smuggling is how one client's request gets attached to another client's connection. Fixed in 4.1.138.Final. On top of those, CVE-2026-93569 (High, CVSS 8.2) lets an HTTP/1 absolute-form Host header override the HTTP/2 :authority pseudo-header during HTTP/1 to HTTP/2 translation, which matters for any gateway or proxy built on Netty.

‍

CVE-2026-84218 is a bypass of the JSR-160 proxy JNDI denylist in Jolokia, via ldaps:// or a non-empty host component, leading to SSRF and credential leakage and possibly RCE. High, CVSS 8.1, and Boot 2.7 is the only EOL line that still manages Jolokia. Two caveats. It only applies when Jolokia runs in proxy mode. And the fix itself lands in jolokia-jsr160, which the Boot BOM does not manage. Bumping jolokia-core through the BOM does not reach the vulnerable code. Applications running Jolokia in proxy mode have to upgrade jolokia-jsr160 to 1.7.3 themselves. Actuator's default Jolokia setup with jolokia-core alone does not run the proxy.

‍

The four Jackson CVEs on Boot 3.4 and 3.5 are all High (CVSS 7.5) but all denial-of-service: a number-validation ReDoS reachable through default databind coercion, an ignored maxErrorTokenLength on DataInput-backed parsers, an unbounded type-id cache on polymorphic types, and quadratic forward-reference resolution under @JsonIdentityInfo. Worth patching, especially the ReDoS since it sits on a default deserialization path, but less urgent than the four above.

‍

What This Looks Like by Spring Boot Line

Same set of CVEs regrouped by which EOL Spring Boot version each one lands on. Fixes overlap heavily because Netty and Tomcat sit under every Boot line.

Two things to notice.

‍

First, the gap between the 2.x and 3.x Tomcat counts is a timing artifact, not a difference in exposure. Tomcat 9.0.121, which the July NES release already shipped on Boot 2.5 and 2.7, contained the August security batch. The 10.1 line got that same batch in 10.1.59, which the July release predated. So Boot 3.2 through 3.5 jump two Tomcat releases this month and pick up both batches (23 CVEs), while Boot 2.5 and 2.7 pick up only September's (12). Every Boot line ends the month at the same place relative to upstream. But a team on Boot 3.x that has been self-managing overrides and skipped 10.1.59 has been carrying eleven unpatched Tomcat CVEs since August, including the longest-prefix constraint bypass (CVE-2026-65182) and the Realm fail-open (CVE-2026-68569).

‍

Second, the Netty row is the same on every line, and the Netty row is the one scanners cannot see. Netty publishes its security fixes as GitHub advisories on its own repository, usually without requesting a CVE ID. For this batch the CVE IDs came later, from Red Hat. The cross-referencing is one-directional and incomplete: most of the Netty advisories carry no CVE ID, while some of the Red Hat records do cite the matching GHSA. As of September 24, 2026, none of the 23 advisories had a package range in OSV or the GitHub Advisory Database. This is a delay rather than a permanent gap (older Netty advisories do eventually land with package data), but it means a team that waits for a scanner to turn red before acting on Netty is going to be several weeks late every time.

‍

The Self-Managed Override Burden

For a team on an EOL Boot version maintaining dependency hygiene in-house, each of the September CVEs is a discrete unit of engineering work: monitor the upstream advisory, determine whether the pinned version is in the affected range, identify every application in the portfolio that consumes the component through the Boot BOM, add a managed-dependency override to each build file, validate that the override does not break Boot's dependency resolution, regression-test each application, resolve compatibility issues, deploy through the release process, and produce release notes and evidence artifacts the security and audit teams can reference.

‍

Multiply that by 52 CVEs in one month. And this month the monitoring step is harder than usual, because the normal shortcut (let the SCA tool tell you) did not work at release time. On September 24, 2026, only three of the 23 Tomcat CVEs had reviewed, package-ranged records in the public databases, and the Netty set had none. The rest exist as vendor security pages, repository advisories without package data, or Red Hat CVE records that may or may not cite the upstream advisory. Reconciling that by hand is the job. The Netty CVE-to-advisory mapping in the appendix below was made by matching titles and descriptions, because no explicit cross-reference exists. Every pairing is one-to-one and unambiguous, but a team doing this in-house has to do that work too.

‍

The Jolokia fix is the other trap. A scanner that does eventually flag CVE-2026-84218 will name jolokia-core, because that is what the CVE record names. The BOM override for jolokia-core 1.7.3 will satisfy the scanner. And the vulnerable code in jolokia-jsr160 will still be at 1.7.2, because the BOM never managed it. Scanner-driven remediation would close the ticket and leave the hole.

‍

Then there are the three hardening bumps that ship no CVE ID at all. tcNative 2.0.84 fixes a ring-buffer heap overflow and a use-after-free in the JNI wrapper. FreeMarker 2.3.35 makes ClassTemplateLoader and WebappTemplateLoader reject template names that climb out of the base path. Jetty 12.0.39 stops the HttpClient AuthenticationStore from sending credentials registered for /secure to /secureX. None of these will ever appear in an SCA report. Some of the tcNative fixes may pick up advisories later; the rest probably will not.

‍

How NES Handles This Work

The HeroDevs Spring engineering team ran the same workflow on the NES for Spring side. The September 2026 release picks up:

• Netty 4.1.138.Final on every supported EOL Boot version
• Tomcat 9.0.122 on Boot 2.5 and 2.7
• Tomcat 10.1.60 on Boot 3.2, 3.3, 3.4, and 3.5
• Jackson 2.18.11 on Boot 3.4 and Jackson 2.21.7 on Boot 3.5
• Jolokia 1.7.3 on Boot 2.7
• FreeMarker 2.3.35 hardening on every supported EOL Boot version
• Jetty 12.0.39 hardening on Boot 3.2, 3.3, 3.4, and 3.5
• Netty tcNative 2.0.84.Final hardening on Boot 2.5
• Build Helper Maven Plugin 3.6.2 on Boot 3.4 and 3.5 (build-time only; clears CVE-2025-67030 from scanner output)

‍

Those bumps ship as patched Boot artifacts at the same Maven and Gradle coordinates the customer already references. The upstream-advisory monitoring layer, the version-range matching against pinned BOM coordinates, the override authoring and BOM compatibility validation, the regression testing on the affected application surface, and the evidence artifacts for audit workflows are the parts the customer team does not have to do. This month that includes the reconciliation of Netty's GitHub advisories against Red Hat's CVE records, so the release notes carry both identifiers for every fix.

‍

NES does not eliminate every code change in every environment. The Jolokia case is the clearest example this month: the BOM-managed bump reaches jolokia-core, and any Boot 2.7 application running Jolokia in proxy mode still needs to bump jolokia-jsr160 in its own build. That is called out in the release notes rather than left for a scanner to miss. What NES does is collapse the dependency-bump workflow into the same release cadence the customer already runs against Spring itself, with documentation suitable for security and compliance evidence.

‍

Taking Action

For teams currently running Spring Boot 2.5, 2.7, 3.2, 3.3, 3.4, or 3.5, three practical steps:

1. Inventory the applications running each Boot line. The HeroDevs EOL Discovery Scanner produces this inventory automatically. This month, also note which of them serve WebSocket, run with HTTP/2 enabled, or are WebFlux applications, because those are the ones the Tomcat and Netty Highs actually reach.
2. Do not wait for your scanner on this one. As of late September 2026, most of the Netty and Tomcat fixes had no package-ranged advisory in the public databases. If your remediation process starts with an SCA alert, it has not started. Treat Tomcat 10.1.60, Tomcat 9.0.122, Netty 4.1.138, and Jackson 2.18.11 / 2.21.7 as the targets regardless of what the scanner says. If you are on Boot 3.x and self-managing, check whether you ever picked up Tomcat 10.1.59; if not, you have two batches to absorb, not one. If you run Jolokia in proxy mode on Boot 2.7, bump jolokia-jsr160 explicitly.
3. Decide whether to self-manage overrides or use NES. If your team has engineering capacity to monitor upstream advisories at the source (not just the databases), reconcile the identifiers, override, test, and document at the cadence upstream projects ship, the self-managed path is real. If that capacity is going to product work, NES for Spring is the supported alternative on the same Maven and Gradle workflow you already use.

If you want to see what the September release looks like against your own Boot inventory, the NES for Spring page has the supported version matrix and a path to talk to the Spring engineering team.

‍

Related Reading

• Spring Boot Managed Dependencies Still Get CVEs After EOL: July 2026 Patch Round-Up
• Spring Boot Managed Dependencies Still Get CVEs After EOL: May 2026 Patch Round-Up
• Spring Boot 3.5 Reaches EOL on June 30, 2026: Why Most Spring Teams Are Running Out of Support
• The Hidden Risk in Spring Boot 2.7: Managed Dependencies Still Matter
• Bob McNees, Spring CVEs Surge in 2026: 37 Vulnerabilities in Two Months
• Steve Poole, Crossing the River Styx: Spring Boot 3.5 and the Zombie Dependency Problem

‍

Appendix: Full CVE List with Advisory Links

Every CVE in the September 2026 release, organized by upstream dependency. Useful for SCA reconciliation, evidence collection, and search-intent landings. Apache rates Tomcat on its own four-level scale (Critical / Important / Moderate / Low); CISA-ADP publishes CVSS 3.1 scores on the same records and they are often much higher. Both are given. Note that OSV and GHSA list Tomcat 10.1.58 as the fixed version for the August batch; 10.1.58 was never released and those fixes first shipped in 10.1.59.

Apache Tomcat (Fixed in 10.1.60 and 9.0.122; reaches every Boot line)

Upstream: Tomcat 10.1 security page, Tomcat 9.0 security page. HeroDevs also offers NES for Apache Tomcat for standalone Tomcat deployments.

• CVE-2026-76183 (Important, ADP 9.8): Bypass of security constraints for WebSocket endpoints. Request paths parsed as endpoint templates slip past container security constraints on Jakarta WebSocket endpoints.
• CVE-2026-86350 (Important, ADP 9.1): Regression in the fix for CVE-2026-41293 allows HTTP/2 request headers to cross between requests. Affects 10.1.55 through 10.1.59 and 9.0.118 through 9.0.121 only; requires HTTP/2.
• CVE-2026-78383 (Important, ADP 7.5): AJP denial of service via a missing request body pins an AJP processing thread. Requires an AJP connector, which Spring Boot does not configure by default.
• CVE-2026-77791 (Important, ADP 7.5): Denial of service via busy wait during WebSocket close. Any application using WebSocket.
• CVE-2026-86248 (Moderate, ADP 9.8): Incomplete fix for CVE-2026-34500. CLIENT_CERT OCSP checks can soft-fail under the OpenSSL-FFM implementation even with soft-fail disabled. Requires mutual TLS with OCSP on OpenSSL-FFM.
• CVE-2026-79677 (Moderate, ADP 7.5): WebSocket denial of service via a lost asynchronous write timeout. Applications using WebSocket async writes.
• CVE-2026-73581 (Moderate, ADP 6.5): OpenSSL and OpenSSL-FFM ignore CRLs when the certificate comes from a keystore. Default JSSE is unaffected.
• CVE-2026-87022 (Low, ADP 7.5): WebSocket message smuggling with per-message-deflate. Requires WebSocket compression negotiated.
• CVE-2026-77762 (Low, ADP 8.1): Stale HPACK emitter injects trailers into a recycled request. Race across HTTP/2 requests; requires HTTP/2.
• CVE-2026-78437 (Low, ADP 7.3): HTTP/2 denial of service via malformed request; timing-dependent failure of another user's request. 10.1.53+ and 9.0.116+ only.
• CVE-2026-75973 (Low, ADP 7.3): Cross-context authentication mix-up with Jakarta Authentication. Requires JASPIC with SimpleAuthConfigProvider across several web apps; rare in Spring Boot.
• CVE-2026-77756 (Low, ADP 3.7): Transfer-Encoding honoured for HTTP/1.0 requests. Behind a reverse proxy, can make another user's request fail.

Apache Tomcat (Fixed in 10.1.59; Boot 3.2, 3.3, 3.4, 3.5 only, since 9.0.121 already carried these)

• CVE-2026-65182 (Important, ADP 9.1): Bypass of longest-prefix security constraint. Declarative (web.xml-style) constraints; Spring Security filter chains are not affected.
• CVE-2026-68569 (Important, ADP 8.1): Principal lookup can fail open in some cases. Tomcat Realm and container-managed authentication.
• CVE-2026-68763 (Important, ADP 7.5): HTTP/2 denial of service via allocation leak when a stream is reset. Requires HTTP/2.
• CVE-2026-65927 (Important, ADP 7.5): RewriteValve [N] flag restarts at the second rule, which may bypass access control. Requires a RewriteValve configured.
• CVE-2026-65637 (Moderate, ADP 9.8): HTTP/2 no-authority bypass of strict SNI validation. 10.1.53 through 10.1.57 only; HTTP/2 over TLS.
• CVE-2026-68525 (Low, ADP 9.1): Redirect after FORM authentication may bypass method-specific constraints. Requires Tomcat FORM authentication.
• CVE-2026-65905 (Low, ADP 9.8): Limited replay attack with DIGEST authentication. Requires Tomcat's DIGEST authenticator.
• CVE-2026-66422 (Low, ADP 8.1): Servlet role references can bypass declarative role constraints. Requires security-role-ref in declarative constraints.
• CVE-2026-65183 (Low, ADP 8.1): TOCTOU when setting permissions on Unix domain sockets. Requires a Unix-domain-socket connector.
• CVE-2026-73180 (Low, ADP 6.8): Authenticated WebSocket session survives the end of the HTTP session. WebSocket endpoints relying on HTTP session authentication.
• CVE-2026-66299 (Low, ADP 7.5): Denial of service in the WebSocket chat example. Examples webapp only; not part of the embedded artifacts Spring Boot ships.

Netty (Fixed in 4.1.138.Final; reaches every Boot line)

Netty publishes security fixes as GitHub advisories on netty/netty, usually without a CVE ID. The CVE IDs below were assigned by Red Hat. Some Red Hat records cite the matching GHSA; where they do not, the pairing was made by title and description. On the Netty side, only GHSA-pq4x-537v-r54q and GHSA-r4xx-7fpg-j8xg carry an explicit cross-reference upstream. Severity is the GHSA label with the Red Hat CVSS in parentheses where it differs.

• CVE-2026-93569 / GHSA-cg2g-fxr4-mg8m (High, 8.2), codec-http2: HTTP/1 absolute-form Host mismatch overrides the HTTP/2 :authority pseudo-header during HTTP/1 to HTTP/2 translation. Proxies and gateways.
• CVE-2026-93567 / GHSA-45h4-vhwh-fmhg (High, 7.5), codec-http2: Authority-form CONNECT becomes a malformed HTTP/2 CONNECT during translation; can bypass tunnel allow-lists.
• CVE-2026-93568 / GHSA-w6j8-x45j-w75f (High, 7.5), codec-http2: Extended CONNECT downgraded to plain CONNECT during HTTP/1 to HTTP/2 translation.
• CVE-2026-93491 / GHSA-pvjx-v7vp-62vq (High, RH 7.5), codec-http: HttpServerCodec unbounded queue under HTTP/1.1 pipelining. Any Netty HTTP/1.1 server, including Reactor Netty and WebFlux.
• CVE-2026-93494 / GHSA-ghg5-c4jg-8q5j (High, 7.5), codec-stomp: StompSubframeDecoder ByteBuf leak on an unterminated body. STOMP codec only.
• CVE-2026-93563 / GHSA-pq4x-537v-r54q (High, 7.5), codec-smtp: SmtpResponseDecoder unbounded multi-line accumulation. Client-side; malicious or MITM SMTP server.
• CVE-2026-93572 / GHSA-r4xx-7fpg-j8xg (High, 7.5), codec-redis: RedisArrayAggregator nested headers multiply the preallocation limit. Netty codec-redis only; Lettuce does not use it.
• CVE-2026-93575 / GHSA-jqf3-r9ww-c5x8 (High, 7.5), codec-mqtt: MqttDecoder resource exhaustion. MQTT codec only.
• CVE-2026-93578 / GHSA-jhjp-5q4f-8wr2 (High, 7.4; RH 5.9), handler-ssl-ocsp: OCSP client skips the Extended Key Usage check. Only with Netty's OCSP validator.
• CVE-2026-93561 / GHSA-wxrh-4rgq-pjcg (High, RH 6.5), codec-memcache: Memcache binary codec frame desync and response smuggling. Memcache codec only.
• CVE-2026-89044 and CVE-2026-93562 / GHSA-hcvj-94mj-jp5c (Medium, 6.5), codec-http: Incomplete Transfer-Encoding validation allows request smuggling. Any Netty HTTP/1.1 server. Two CVE IDs (Red Hat and VulnCheck) for one flaw.
• CVE-2026-93573 / GHSA-3jrc-fchc-59pw (Medium, 6.5), codec-http: Split Transfer-Encoding fields bypass the final-chunked check. Any Netty HTTP/1.1 server.
• CVE-2026-93566 / GHSA-rq4j-fc47-9698 (Medium, 6.5), codec-http: Control characters in the chunk-size line allow smuggling. Any Netty HTTP/1.1 server.
• CVE-2026-93574 / GHSA-j4mg-hqgv-34qc (Medium, 6.5), codec-http: Post-digit whitespace in chunk-size allows smuggling. Any Netty HTTP/1.1 server.
• CVE-2026-93558 / GHSA-2g37-3h88-55hc (Medium, 5.3; RH 7.5), codec-http: WebSocketServerExtensionHandler unbounded queue. WebSocket servers using the extension handler.
• CVE-2026-93492 / GHSA-8352-h356-c9qh (Medium, 5.3), codec-http2: HpackEncoder denial of service with a large table size. Any HTTP/2 endpoint.
• CVE-2026-93493 / GHSA-jj3c-mwvr-9g52 (Medium, 5.9), handler-ssl-ocsp: OCSP validation skipped when nextUpdate is omitted. Only with Netty's OCSP validator.
• CVE-2026-93488 / GHSA-rmcw-9fcq-wjq7 (Medium, RH 7.5), codec-http: SpdySessionHandler unlimited concurrent streams. SPDY only.
• CVE-2026-93565 / GHSA-h75q-xqrh-59rf (Medium, RH 7.5), codec-http: RtspDecoder method-token smuggling. RTSP only.
• CVE-2026-93560 / GHSA-hmf3-49g9-g7qq (Medium, RH 7.5), codec-stomp: STOMP content-length truncation causes an infinite decode loop. STOMP codec only.
• CVE-2026-93576 / GHSA-5vh9-c45f-rf7p (Medium, RH 7.5), codec-smtp: SMTP command name not CRLF-validated; incomplete fix of CVE-2025-59419. Only if untrusted input reaches an SMTP command name.
• CVE-2026-93564 / GHSA-j58c-g352-8h4p (Medium, 5.3; RH 7.5), codec-haproxy: HAProxy PROXY-v2 nested-TLV ByteBuf leak. HAProxy PROXY decoder only.
• CVE-2026-93579 / GHSA-8whp-c7w8-2m72 (Low, RH 6.5), codec-http2: HTTP/2 header values not validated for CR, LF, or NUL by default. Dangerous across an HTTP/2 to HTTP/1.1 boundary.

Jackson (Fixed in 2.18.11 and 2.21.7; Boot 3.4 and 3.5)

Upstream: jackson-core advisories, jackson-databind advisories. HeroDevs also offers NES for Jackson.

• CVE-2026-89407 / GHSA-p6pp-m3f8-5c89 (High, 7.5), jackson-core: ReDoS from quadratic backtracking in NumberInput.looksLikeValidNumber(). Reachable when untrusted strings are coerced to numbers, which is a default databind path.
• CVE-2026-89425 / GHSA-7hhh-6rmp-j9qf (High, 7.5), jackson-core: UTF8DataInputJsonParser ignores maxErrorTokenLength. Only parsers created over a DataInput; InputStream and Reader parsing is bounded.
• CVE-2026-91776 / GHSA-wv8q-qhhj-9h54 (High, 7.5), jackson-databind: Type-id cache retains every unknown type id. Polymorphic types (@JsonTypeInfo with defaultImpl) receiving untrusted input.
• CVE-2026-91777 / GHSA-cxp5-3px4-pw24 (High, 7.5), jackson-databind: Quadratic forward-reference completion in Collection and Map deserializers. @JsonIdentityInfo on collection or map elements with attacker-controlled references.

Jolokia (Fixed in 1.7.3; Boot 2.7)

Upstream: Jolokia releases.

• CVE-2026-84218 (High, 8.1): Bypass of the JSR-160 proxy JNDI denylist via ldaps:// or a non-empty host, leading to SSRF and credential leakage, possibly RCE. Proxy mode only. The code change is in jolokia-jsr160, which the Boot BOM does not manage; applications running the proxy must upgrade that artifact directly.

Build Helper Maven Plugin 3.6.2 (Boot 3.4 and 3.5, build-time only)

• CVE-2025-67030 (High, NVD 8.8): The plugin's own plexus-utils dependency moves from 4.0.2 to 4.1.0, past the 4.0.3 fix for Expand.extractFile directory traversal. The plugin never calls Expand, so the practical effect is that scanners stop flagging it. Does not reach application runtime.

Netty tcNative 2.0.84.Final, FreeMarker 2.3.35, and Jetty 12.0.39

Security hardening with no CVE assigned. Will not appear in SCA scanner output. tcNative 2.0.84 (Boot 2.5) fixes a ring-buffer heap overflow, a use-after-free on session-ticket key rotation, signing errors reported as success in SSLPrivateKeyMethod, and embedded NULs in the SNI name; only relevant when the native OpenSSL/BoringSSL provider is in use, and some of these may receive advisories later. FreeMarker 2.3.35 (all Boot lines) makes ClassTemplateLoader and WebappTemplateLoader reject template names that escape the base path, blocks system-property listing under the default member-access policy, and deprecates the XXE-prone NodeModel helpers. Jetty 12.0.39 (Boot 3.2 through 3.5) makes the jetty-client AuthenticationStore match stored credentials on canonical path-segment boundaries; the September Jetty CVEs themselves were already fixed at 12.0.38. Included in the NES bumps because the upstream release notes and commit history flag them as security-relevant.