This Week in Spring: September 30th, 2025

Hi, Spring fans! As I write this I am about to board a flight for Colorado for the amazing Dev2Next conference! I'll be in Antwerp, Beglium for the amazing Devoxx event next week, and I'll be speaking at the Amsterdam JUG with James Ward on the Thursday after that, too! If you're around, be sure ...

cc.ddrpa.dorian.polystash:polystash-spring-boot-starter (=1.0.0), cc.ddrpa.dorian:forvariz-spring-boot-starter (>=1.0.0 <=1.1.0) +827 more potentially affected by CVE-2025-59952 via io.minio:minio (>=7.0.1 <=8.5.9)

io.minio:minio MAVEN version =7.0.1, =1.0.0, =1.0, =1.0.1, =1.3.0.RELEASE, =1.0.0, =1.0.0, =1.0.0, =0.2.2, =11.0.1-RELEASE, =11.0.1-RELEASE, =12.0.1-RELEASE - cn.bootx.platform:bootx-demo =1.2.3 and more Source cves: CVE-2025-59952 Source advisory: SNYK:JAVA-IOMINIO-13147656...

cc.ddrpa.dorian.polystash:polystash-spring-boot-starter (=1.0.0), cc.ddrpa.dorian:forvariz-spring-boot-starter (>=1.0.0 <=1.1.0) +997 more potentially affected by CVE-2025-59952 via io.minio:minio (>=0.2.3 <=8.5.9)

io.minio:minio MAVEN version =0.2.3, =1.0.0, =1.0, =1.0.1, =1.3.1, =1.0.1, =1.3.0.RELEASE, =1.0.0, =1.0.0, =1.0.0, =0.2.2, =11.0.1-RELEASE, =12.0.1-RELEASE and more Source cves: CVE-2025-59952 Source advisory: OSV:GHSA-H7RH-XFPJ-HPCM...

Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell CVE-2021-44228 PoC Objective Reproduce, explo...

CicadasCMS 代码注入漏洞

CicadasCMS is a content management framework based on SpringBoot Mybatis SpringSecurity Vue developed by westboy individual developers in China. A code injection vulnerability exists in CicadasCMS version 1.0, which originates from the incorrect operation of the parameter categoryName in the file...

A Bootiful Podcast: Spring Batch lead Mahmoud Ben Hassine

Hi, Spring fans! In this installment we talk to the legendary lead of the Spring Batch project, Mahmoud Ben Hassine, about the latest-and-greatest in Spring Batch in the Spring Boot 4 generation...

This Week in Spring - September 23rd, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm preparing my talks for several amazing shows including: Commit Your Code conference in Plano, Texas starting tomorrow; Dev2Next in Colorado; Devoxx Belgium in Antwerp, Belgium; and CloudFoundry Days in Germany. So much go...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +137 more potentially affected by CVE-2025-8419 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=26.2.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.0.1, =1.0.2 - com.kleegroup.accelerator:accelerator-security-keycloakmfa =1.0.1 and more Source cves: CVE-2025-8419 Source advisory:...

CVE-2025-41249 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, jenkins, zipkin, apache-nifi, conductor, conductor-fips, nacos, apache-hop-fips, apache-activemq-fips, apache-nifi-registry, thingsboard, keycloak-config-cli, apache-hop, apache-activemq, nacos-docker...

GHSA-JMP9-X22R-554X vulnerabilities

Vulnerabilities for packages: camunda-zeebe, jenkins, zipkin, apache-nifi, conductor, conductor-fips, nacos, apache-hop-fips, apache-activemq-fips, apache-nifi-registry, thingsboard, keycloak-config-cli, apache-hop, apache-activemq, nacos-docker...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (>=0.2.0 <=0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0 <=0.28.0) +23963 more potentially affected by CVE-2025-41249 via org.springframework:spring-core (>=6.0.0 <=6.2.10)

org.springframework:spring-core MAVEN version =6.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.12.1 and more Source cves: CVE-2025-41249 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-12817817...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (=0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (=0.28.0) +18180 more potentially affected by CVE-2025-41249 via org.springframework:spring-core (>=6.0.0 <=6.1.21)

org.springframework:spring-core MAVEN version =6.0.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.12.1 - ai.djl.spring:djl-spring-boot-starter-autoconfigure =0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto =0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-linux-x8664 =0.2...

Linux Distros Unpatched Vulnerability : CVE-2019-9186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the...

This Week in Spring - September 9th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I am home, ensconced in my studio here in somewhat sunny San Francisco, California, relaxing and trying to catch up on stuff I missed. As always, there's a ton! So let's dive right into it. Some of the amazing features that...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228 Remote Code Injection In Log4j https://twitter.com/jas502n/status/1468946197629272066 SpringBoot-pom.xml default use : xml org.springframework.boot spring-boot-starter-web mvn dependency:tree java INFO | | +- org.springframework.boot:spring-boot-starter-logging:jar:2.6.1:compile IN...

ai.ancf.lmos-router:benchmarks (>=0.2.0 <=0.28.0), ai.ancf.lmos-router:lmos-router-hybrid (>=0.2.0 <=0.28.0) +18174 more potentially affected by CVE-2025-58057 via io.netty:netty-codec-http2 (>=4.1.0.Beta4 <=4.1.124.Final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.Beta4, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid =0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter =0.1.0 - ai.ancf.lmos:lmos-router-llm =0.1.0 -...

The Road to GA - Introduction

As you all should be aware by now, the Spring portfolio is in the process of driving towards the next major versions to be released in November of this year. This will be only the fourth major generation for Spring Boot and the seventh major generation for Spring Framework in its over 20 year...

This Week in Spring - September 2nd, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Frankfurt, awaiting my flight to the Java-tastic Javazone 2025 event where I'll be joined by the legendary James Ward to deliver an AI-focused look at the latest-and-greatest in Spring! And I'm still recovering from th...

Linux Distros Unpatched Vulnerability : CVE-2024-38807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be...

This Week in Spring - August 26th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm writing this from the floor of SpringOne, live from lovely Las Vegas! As you can imagine, I've got to get back into it, so we'll make this one a quick one. And if you're here, be sure to say "hi"! In last week's A Bootifu...