935 matches found
This Week in Spring - July 23rd, 2024
Hi, Spring fans! It's such an exciting time to be alive! I hope you're doing well. It's nearly the end of July, already! Time is flying and as always the community has not disappointed with their incredible content. Let's dive right into it! have you registered for SpringOne 2024 yet? I love this...
This Week in Spring - July 9th, 2024
Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it's been! We've got a lot to get into, so let's dive right in. I quite liked this talk, Continuations: The magic behind virtual threads in Java by Balkrishna Rawool @ Spring I/O 2024 In last week's episode of...
Spring Cloud Function Web DOS Vulnerability
Description In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is...
Spring Tips: Introducing Spring Modulith
Hi, Spring fans! In this installment we look at the amazing Spring Modulith project. It's goal is to help you better structure your codebase for architectural scalability. It's an amazing and refreshing approach to building applications. Think of it like a chance to pair program on the architectu...
A Bootiful Podcast: Stuart Marks (aka ”Dr. Deprecator”) on Java, its amazing features, and more
Hi, Spring fans! Happy one-day-belated Java 22 release day to those who celebrate! To ring in the new release, we've got an extra special and incredible discussion with a Java legend - somebody who's been involved in the Java community and work for decades - Stuart Marks, or "Dr. Deprecator," as...
A Bootiful Podcast: Roni Dover on Digma AI
Hi, Spring fans! In this installment we talk to Digma AI founder Roni Dover...
This Week in Spring - December 12th, 2023
Hi, Spring fans! Welcome to a new installment of This Week in Spring! We've got a ton of stuff to get into, so let's dive right in! Laur Spilca and I look at how to ugprade a Spring Security 5.x application to Spring Security 6.x. Apache SkyWalking with Sheng Wu and Apache ShardingSphere with...
A Bootiful Podcast: Java Language Architect Brian Goetz
Hi, Spring fans! Are you using Java 21 in production already? No? you should listen to this episode. Yes? Then you should listen to this episode! This week, Josh Long talks to legendary Java Language Architect Brian Goetz @BrianGoetz recaping the latest-and-greatest and previewing Java.next...
A Bootiful Podcast: Gradle Developer Advocate, Java Champion, and legend Trisha Gee
Hi, Spring fans! In this installment, Java Champion and legend Trisha Gee @trishagee rejoins the show to talk about Gradle, developer productivity, and so much more...
A Bootiful Podcast: Spring Cloud Stream and Spring Cloud Function lead Oleg Zhurakousky
Hi Spring fans! Welcome to another installment of a bootiful podcast! in this installment, our pal Oleg Zhurakousky @zoleg, lead of Spring Cloud Stream and Spring Cloud Function, rejoins the show to talk about the latest and greatest in stream processing...
A Bootiful Podcast: opensource, Spring Cloud, and Kubernetes maestro Abel Salgado Romero
Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Abel Salgado Romero @abelsromero about open source, Kubernetes, and building Kubernetes controllers with Spring Boot and GraalVM native images...
A Bootiful Podcast: GraalVM advocate Alina Yurenko on a Bootiful Podcast
Liiiive from New York, it's a Bootiful Podcast! This week I @starbuxman talk to Developer Advocate for GraalVM at Oracle Labs, and legend, Alina Yurenko @alinayurenko...
Insufficiently random session id in Java SockJS client
Session id generation in the Java SockJS client is not sufficiently secure and could allow a user to send messages to another user’s session. Note that this only affects users of the Java SockJS client, which generates its own session id. It does not affect browser clients even if they’re...
A Bootiful Podcast: Sébastien Deleuze on the latest-and-greatest in Spring AI and Spring Framework
Hi Spring fans! In this installment we talk to the legendary Spring AI and Spring Framework contributor Sébastien Deleuze about the latest-and-greatest in AI, Kotlin, the framework, and more...
cve-2026-47825 - HIGH - Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations
cve-2026-47825 - HIGH - Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations...
cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability
cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability...
This Week in Spring - June 9th, 2026
Hi Spring fans! Welcome to another installment of This Week in Spring! Tons of releases coming out today and this week! So make sure you're pulling in the latest posts, as often as possible! Spring LDAP 2026.06 Releases - Contains CVE Fix Spring Framework 7.0.8 and 6.2.19 Available Now Spring...
cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider...
cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution
cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution...
cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys...
cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP
cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...
Spring Framework Denial of Service via AntPathMatcher
Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher :...
A Bootiful Podcast: Microsoft's Martijn Verburg
Hi Spring fans! In this installment, I talk to my friend from JClarity and Microsoft fame, fellow Java champion, and Java guru Martijn Verburg ai microsoft java jclarity performance...
A Bootiful Podcast: Hadi Hariri, Jetbrains legend
Hi Spring and Kotlin fans! In this installment, I have the privilege of talking to my old friend and JetBrains legend Hadi Hariri, recorded live from Kotlin Conf 2026 in Munich, Germany! kotlin jvm java springboot...
Unbounded cache for function definitions
OOM error is possible while attempting to add infinite amount of functions to Function Registry...
Spring Cloud Config Server Logged Sensitive Information
When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs...
VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId . Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input ...
A Bootiful Podcast: A Bootiful Podcast: Dr. Venkat Subramaniam and James Ward on Intelligent Kotlin and So Much More
I am beyond thrilled that I got to co-present with two legends, Dr. Venkat Subramaniam and James Ward, at Voxxed Days Amsterdam, and even more so that they both sat down for a quick discussion with me right before that presentation. Enjoy!...
Spring Framework DoS with Multipart Temp Files in WebFlux
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space...
A Bootiful Podcast: Daniel Garnier-Moiroux on MCP Security
Hi Spring, AI, Spring AI, security, and Spring Security fans! In this installment I talk to the legendary Daniel-Garnier Moiroux! ai mcp security java...
This Week in Spring - March 10th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring. As I write this, I am preparing for a trip to Rust, Germany, for one of the best Java conferences in Europe: JavaLand, along with its new companion event, DevLand. It should be fun. Will you be around? If so, say hi. We have ...
This Week in Spring - March 9th, 2026
Hi Spring fans! Welcome to another rip-roaring installment of This Week in Spring! I'm writing this in an Uber en route to the airport to get to awsome Atlanta, GA, for Devnexus 2026! Who's goin'? You goin'? We - the Spring team - will be there in force! Come say hi at the boothes or come see our...
This Week in Spring - January 27th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this, I cannot believe we're nearly at the end of the month! Time sure flies. Spring AI 2.0.0-M2 is available now Spring Modulith 2.1 M1, 2.0.2, and 1.4.7 released In last week's installment of A Bootiful Podcast ,...
This Week in Spring - January 6th, 2026
Hi, Spring fans, to the first installment of This Week in Spring in the new year and , roughly, the fifteenth anniversary edition of this series! I've been writing these blogs since the first week of January of 2011, and I am proud to say that I haven't so far missed a single week! I've always...
Connect Your AI to Everything: Spring AI's MCP Boot Starters
The Model Context Protocol MCP standardizes how AI applications interact with external tools and resources. Spring joined the MCP ecosystem early as a key contributor, helping to develop and maintain the official MCP Java SDK that serves as the foundation for Java-based MCP implementations...
This Week in Spring - September 9th, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring! I am home, ensconced in my studio here in somewhat sunny San Francisco, California, relaxing and trying to catch up on stuff I missed. As always, there's a ton! So let's dive right into it. Some of the amazing features that...
A Bootiful Podcast: Spring Cloud guru Ryan Baxter
Hi, Spring fans! In this installment we talk to the amazing Spring Cloud contributor Ryan Baxter, live from SpringOne 2025!...
The Road to GA - Introduction
As you all should be aware by now, the Spring portfolio is in the process of driving towards the next major versions to be released in November of this year. This will be only the fourth major generation for Spring Boot and the seventh major generation for Spring Framework in its over 20 year...
Authentication Leak On Redirect With Reactor Netty HTTP Client
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects...
A Bootiful Podcast: DevOps and AI luminary Patrick Debois
Hi, Spring, cloud native, and AI fans! In this installment, I had the opportunity to briefly sit down and talk with DevOps and AI luminary Patrick Debois, from the amazing Devoxx UK 2025 show...
A Bootiful Podcast: Micrometer.io lead Tommy Ludwig on the latest-and-greatest in observability for the Spring developer
Hi, Spring fans! In this episode, I talk to Micrometer.io lead Tommy Ludwig on the latest-and-greatest in observability for the Spring developer...
RFD Attack via “Content-Disposition” Header Sourced from Request
In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an...
A Bootiful Podcast: IntelliJ IDEA lead Aleksey Stukalov
Hi, Spring fans! In this installment I talk to IntelliJ IDEA lead Aleksey Stukalov...
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies...
Spring Security authorization bypass for method security annotations on private methods
Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: In that case, the target method may be able to be invoked without proper authorization. You...
Spring Security BCryptPasswordEncoder maximum password length breaks timing attack mitigation
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider...
A Bootiful Podcast: Spring Legend Glenn Renfro on Devnexus 2025, Cold brews, and More
Hi, Spring fans! In today's installment, I talk to Spring legend Glenn Renfro...
This Week in Spring - February 4th, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's February 4th, 2025, as I write this. We are ten days away from Valentine's day, and about a month away from Devnexus. Lots to look forward to, in both the short term and the long term! Let's dive right into this week's...
This Week in Spring - January 7th, 2025
Hi, Spring fans, and happy new year! It's been another super seven days since we last spoke and, as always, there's a lot to cover so let's dive right into it! A long time in coming, but it's finally here! Hello DCO, Goodbye CLA: Simplifying Contributions to Spring the Spring AI hits just keep on...
Extending Spring Data Repositories Just Got Easier
Since its inception, Spring Data Repositories have been designed for extension, whether you want to customize a single query method or provide a completely new base implementation. The 2024.1 release enhances your ability to extend a repository with custom functionality making it easier than ever...