Spring End-of-Life Resource Hub
End of life doesn’t have to mean end of support. Find strategies, resources, and solutions for keeping your Spring applications stable, secure, and compliant.
.png)
.png)
Featured Articles
Browse expert insights, industry news, analyses, and how-tos on navigating Spring and Java end-of-life transitions.
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
![CVE-2024-38828: DoS via Spring MVC Controller Method with byte[] Parameter](https://cdn.prod.website-files.com/62876589ec366575fa309b1e/673e0f6a7971ec7d5afa92c9_CVE-2024-38828.png)
.png)
.png)
.png)
.png)
.png)
.png)
10 Tomcat CVEs to Watch Out for in 2025 (Patched by HeroDevs NES)
From RCE to DoS, these 2025 Apache Tomcat vulnerabilities target versions still widely used in production. HeroDevs NES neutralizes the threat.
Never-Ending Support Now Covers Spring Boot 3.2 and 3.4
Secure Spring Boot 3.2 & 3.4 Beyond End-of-Life with Never-Ending Support
Never-Ending Support Now Covers Spring Boot 3.2 and 3.4
Secure Spring Boot 3.2 & 3.4 Beyond End-of-Life with Never-Ending Support
Explore CVEs on EOL Java Libraries
Monitor and learn more about known vulnerabilities in legacy Spring and other popular Java libraries.
Severity
ID
Technology
Libraries Affected
Category
Version(s) Affected
Published Date
High
Spring
Spring Cloud Gateway
Information Exposure
>=3.1.0 <=3.1.11, >=4.0.0, >=4.1.0 <=4.1.11, >=4.2.0 <=4.2.5, >=4.3.0 <=4.3.1
Oct 21, 2025
Medium
Spring
Spring Framework
Cross-site Request Forgery
>=6.2.0 < 6.2.12, >=6.1.0 < 6.1.24, >=6.0.0 <=6.0.29, >=5.3.0 < 5.3.46, <5.3.0, >4.3.0 <= 4.3.30
Oct 21, 2025
Medium
Spring
Spring Framework
Privilege Abuse
>=5.3.0 <=5.3.44, >=6.0.0 <=6.0.29, >=6.1.0 <6.1.23, >=6.2.0 <6.2.11
Sep 22, 2025
Critical
Spring
Spring Cloud Gateway
Incorrectly Configured Access Control
>=3.1.0 <=3.1.9, >=4.0.0 <=4.0.9, >=4.1.0 <=4.1.9, >=4.2.0 <4.2.5, >=4.3.0 <4.3.1
Sep 10, 2025
Medium
Spring
Spring Framework
Path Traversal
>=4.3.0 <=4.3.30, >=5.3.0 <=5.3.43, >=6.0.0 <=6.0.29, >=6.1.0 <=6.1.21, >=6.2.0 <=6.2.9
Aug 18, 2025
High
Spring
Spring Cloud Gateway
HTTP Request Smuggling
<=3.1.10, >= 4.0.0 <= 4.0.10, >=4.1.0 <4.1.8, >=4.2.0 <4.2.3, >4.3.0-{M1, M2, RC1} < 4.3.0
Jun 2, 2025
Low
Spring
Spring Framework
Authorization Bypass
>=4.3.0 <=4.3.30, >=5.3.0 <=5.3.42, >=6.0.0 <=6.0.27, >=6.1.0 <6.1.20, >=6.2.0 <6.2.7
May 15, 2025
High
Spring
Spring Security
Authorization Bypass
>=5.7.0 <5.7.12, >=5.8.0 <5.8.11, >=6.0.0 <6.0.10, >=6.1.0 <6.1.8, >=6.2.0 <6.2.3
May 8, 2025
Medium
Spring
Spring Boot
Incorrectly Configured Access Control
<2.7.0, >=2.7.0 <2.7.25, >=3.1.0 <3.1.16, >=3.2.0 <3.2.14, >=3.3.0 <3.3.11, >=3.4.0 <3.4.5
Apr 25, 2025
Medium
Spring
Spring Security
Information Exposure
=5.7.16, =5.8.18, =6.0.16, =6.1.14, =6.2.10, =6.3.8, =6.4.4
Apr 22, 2025
Medium
Spring
Spring Cloud Config
Authorization Bypass
>=2.2.0 <=2.2.8, >=3.0.0 <=3.0.7, >=3.1.0 <3.1.10, >=4.0.0 <=4.0.5, >=4.1.0 <4.1.6, >=4.2.0 <4.2.1
Apr 10, 2025
High
Spring
Spring Security
Authorization Bypass
<=5.6.12, >=5.7.0 <5.7.16, >=5.8.0 <5.8.18, >=6.0.0 <=6.0.16, >=6.1.0 <6.1.14, >=6.2.0 <6.2.10, >=6.3.0 <6.3.8, >=6.4.0 <6.4.4
Mar 20, 2025
Medium
Spring
Spring for Apache Kafka
Remote Code Execution
<2.9.11, >=3.0.0 <3.0.10
Mar 3, 2025
Low
Spring
Spring LDAP
Authorization Bypass
<=2.4.3, >=3.0.0 <=3.0.9, >=3.1.0 <=3.1.7, >=3.2.0 <3.2.7
Nov 20, 2024
Medium
Spring
Spring Security
Authorization Bypass
<=5.7.13, >=5.8.0 <=5.8.15, >=6.0.0 <=6.0.13, >=6.1.0 <=6.1.11, >=6.2.0 <=6.2.7, >=6.3.0 <=6.3.4
Nov 19, 2024
Featured Whitepaper
Deep-dive reports and technical briefings on migration, risk, and long-term Java strategy.
Java in 2025:
Navigating Migration, Security, and Long-Term Risk
The question for CIOs, CISOs, and engineering leaders is no longer whether to continue relying on Java. It is how to migrate safely between LTS versions, reduce exposure in legacy environments, and implement governance frameworks that withstand regulatory scrutiny.This white paper provides detailed analysis of migration realities, real-world breach lessons, supply-chain risk, and the economic, regulatory, and vendor dynamics shaping enterprise decisions in 2025.
Ready to Eliminate EOL Risk?
Start scanning your codebase today. Identify every end-of-life package in minutes, not hours.
CVEs Explained
Go under the hood of major Spring and Java CVEs as our team dissects the exploit, explains the patch, and shows you how to defend your stack.
CVE-2025-48976
Denial of Service
High
Project Affected:
Apache Commons Fileupload in Struts
Versions:
>=1.0 <1.6.0
>=2.0.0-M1 <2.0.0-M
CVE-2025-46701
Path Traversal
High
Project Affected:
Apache Tomcat in Apache Tomcat
Versions:
>=9.0.0.M1 <9.0.105
>=10.1.0-M1 <10.1.41
>=11.0.0-M1 <11.0.7
CVE-2025-31651
Command Injection
Critical
Project Affected:
Apache Tomcat in Apache Tomcat
Versions:
>=9.0.76 <9.0.104
>=10.1.10 <10.1.40
>=11.0.0-M2 <11.0.6
CVE-2025-48734
Remote Code Execution
High
Project Affected:
Apache Commons Beanutils in Struts
Versions:
>=1.0 <1.11
>=2.0.0-M1 <2.0.0-M2
Get Started