This Week in Spring - April 21st, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! What a week it's been since we last talked. I was in Barcelona, Spain, for the amazing Spring I/O event there. It has become my favorite show, full stop. Just such an amazing experience. So many wonderful things going on there...

This Week in Spring - November 18th, 2025

This Week in Spring - November 18th, 2025 Hi, Spring fans! I'm thrilled to be in New York City for an exciting week of joint presentations on Spring AI + Bedrock and Spring Boot with the legendary James Ward. First up: we'll present a workshop at the AI Native Dev Conf today, then speak at the...

EUVD-2023-1091

Malicious code in bioql PyPI...

This Week in Spring - June 24th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! We're in the middle of June already! And you know what that means? Warm weather, fun, and of course: the amazing SpringOne event in lovely Las Vegas, NV! The content catalog went live today! I'll be there doing, among other...

CVE-2023-20859

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token...

CVE-2025-22232: Improper Authentication

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

This Week in Spring - 28 November, 2023

Hi, Spring fans! I hope everyone who celebrated Thanksgiving had a wonderful time. Did you indulge in too much turkey? Anyway, let's jump into this week's edition of This Week in Spring—a particularly special one for a couple of reasons. First, it's our first issue after the launch of Spring Boot...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. VMware Tanzu Spring Security and Spring Framework could allow a remote attacker to bypass security restrictions. VMware Tanzu Spring...

Insecure Session Management

spring-vault-core is vulnerable to Insecure Session Management. The vulnerability exists because the library does not properly hide sensitive information from logs after a revocation failure, which allows an attacker to insert sensitive information into a log file when it attempts to revoke a Vau...

org.apereo.cas:cas-server-core-configuration-cloud-vault (>=5.2.0-rc2, <=5.2.9), org.springframework.cloud:spring-cloud-starter-vault-config (1.0.2.release) +5 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.0.2.release)

org.springframework.vault:spring-vault-core MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-vault...

io.pivotal.spring.cloud:spring-cloud-vault-localconfig-connector (1.0.0.release), net.nemerosa.ontrack:ontrack-extension-vault (>=experimental-pipeline-a6e0b79, <=3.41-beta.18) +9 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.1.1.release)

org.springframework.vault:spring-vault-core MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - io.pivotal.spring.cloud:spring-cloud-vault-localconfig-connector...

org.apereo.cas:cas-server-core-configuration-cloud-vault (5.2.0-rc1) potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.0.1.release)

org.springframework.vault:spring-vault-core MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-vault 5.2.0-rc...

org.apache.camel.quarkus:camel-quarkus-hashicorp-vault (3.0.0-m1), org.apache.camel.quarkus:camel-quarkus-hashicorp-vault-deployment (3.0.0-m1) +11 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (3.0.0)

org.springframework.vault:spring-vault-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apache.camel.quarkus:camel-quarkus-hashicorp-vault 3.0.0-m1 -...

com.bpfaas:bps-config-server-spring-cloud-starter (>=0.0.1.release, <=3.2.2), com.github.paulcwarren:spring-content-encryption (>=2.7.0, <=2.9.0) +137 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (>=2.0.1.release, <=2.3.2)

org.springframework.vault:spring-vault-core MAVEN version =2.0.1.release, =0.0.1.release, =2.7.0, =0.8, =0.8, =0.8, =0.8, =2.4.0, =0.9.1, =0.9.12, =0.10.2, =1.1.6, =1.2.16 and more Source cves: CVE-2023-20859 Source advisory: OSV:GHSA-R47R-87P9-8JH3...

org.springframework.cloud:spring-cloud-starter-vault-config (>=1.1.1.release, <=1.1.2.release), org.springframework.cloud:spring-cloud-vault-config (>=1.1.1.release, <=1.1.2.release) +4 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.1.2.release)

org.springframework.vault:spring-vault-core MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.springframework.cloud:spring-cloud-starter-vault-config...

org.apache.camel.quarkus:camel-quarkus-hashicorp-vault (3.0.0-m1), org.apache.camel.quarkus:camel-quarkus-hashicorp-vault-deployment (3.0.0-m1) +11 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (3.0.0)

org.springframework.vault:spring-vault-core MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apache.camel.quarkus:camel-quarkus-hashicorp-vault 3.0.0-m1 -...

org.springframework.cloud:spring-cloud-starter-vault-config (1.1.3.release), org.springframework.cloud:spring-cloud-vault-config (1.1.3.release) +4 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.1.3.release)

org.springframework.vault:spring-vault-core MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.springframework.cloud:spring-cloud-starter-vault-config...

com.bpfaas:bps-config-server-spring-cloud-starter (>=0.0.1.release, <=3.2.2), com.github.paulcwarren:spring-content-encryption (>=2.7.0, <=2.9.0) +137 more potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (>=2.0.1.release, <=2.3.2)

org.springframework.vault:spring-vault-core MAVEN version =2.0.1.release, =0.0.1.release, =2.7.0, =0.8, =0.8, =0.8, =0.8, =2.4.0, =0.9.1, =0.9.12, =0.10.2, =1.1.6, =1.2.16 and more Source cves: CVE-2023-20859 Source advisory: GHSA-R47R-87P9-8JH3...

GHSA-R47R-87P9-8JH3 Spring Vault vulnerable to insertion of sensitive information into a log file

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token...

Spring Vault vulnerable to insertion of sensitive information into a log file

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token...