This Week in Spring - July 4th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week I am in sweltering, but lovely, Singapore, where I'm meeting with customers and just finished presenting at the SpringOne Tour Singapore stop. If you're in Singapore, I hope you'll join me tonight for Bootiful Sprin...

A Bootiful Podcast: Sebastien Deleuze and James Ward on a Bootiful Podcast

Hi, Spring fans! In this installment, recorded live from Kotlin Conf 2023 in Amsterdam, I talk to Kotlin luminaries Sébastien Deleuze and James Ward about Kotlin's future, web assembly, and more...

This Week in Spring - April 11th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this I am in Amsterdam, Netherlands, preparing to speak at the Utrecht JUG tonight along with fellow Java Champion Trisha Gee. We're not speaking together, but instead it's a double header: she'll speak first, then...

Spring Data JPA introduces query parser!

The Problem One of Spring Data JPA’s handy features is letting you plugin in custom JPA queries through its @Query annotation. This allows some flexiblity because you are still able to offer sort parameters to the consumers of your app. Check out the example below: interface SampleRepository...

This Week in Spring - October 11th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! I write this installment as I pack and prepare for my trip to Antwerp, Belgium, for the always-amazing Devoxx show in Antwerp, Belgium. Ive so missed this show over the pandemic and am so looking forward to returning. I hope ...

A Bootiful Podcast: big data legend, former Pivot, and friend to the Spring community, Tim Spann

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to big data legend, former Pivot, and friend to the Spring community, Tim Spann @PaaSDev, about big data, StreamNative, and Apache Pulsar, and Spring for Apache Pulsar. Get your notebooks ready for this one, class!...

A Bootiful Podcast: Dr. Kris De Volder on Spring Tools, VS Code, and so much more

Hi, Spring fans! In this episode Josh Long @starbuxman talks to Dr. Kris De Volder, a longtime member of the Spring Tools team, about all the cool stuff hes worked on and is going to work on. And then we get knee deep into a discussion around building IDE integrations...

A Bootiful Podcast: Spring Cloud and Spring Cloud Kubernetes contributor Ryan Baxter

Hi, Spring fans! In this episode, Josh Long @starbuxman talks to a person who knows more than most about the awesome implications of both the words "Spring" and "Cloud," Spring Cloud Kubernetes lead Ryan Baxter @ryanjbaxter...

Spring Expression DoS Vulnerability

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0 - 5.2.19, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition...

Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096)

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more...

Spring Cloud Gateway Request Vulnerability

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services...

Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted UR...

CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC spring-webmvc module or Spring WebFlux spring-webflux module endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not inclu...

Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a...

Issuer validation regression in Spring Cloud SSO Connector

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

Spring Security / MVC Path Matching Inconsistency

Both Spring Security and the Spring Framework rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Securit...

A Bootiful Podcast: Netflix's Paul Bakker

Hi, Spring fans! This week’s interview is a must-watch if you care about where Java is headed next. This week, I talk to Netflix's Paull Bakker! We dig into Netflix’s real-world playbook for scaling Java, cutting costs with newer JDKs, and replacing reactive complexity with virtual threads and...

Spring Office Hours Podcast: S5E21 - Pro Spring Boot 4 with Felipe Gutierrez

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by returning guest Felipe Gutierrez, co-author with DaShaun of the new book "Pro Spring Boot 4: An Authoritative Guide with Best Practices" from Apress. Felipe and DaShau...

CVE-2026-59322

CVE-2026-59322...

CVE-2026-59320

CVE-2026-59320...

CVE-2026-41850

CVE-2026-41850...

CVE-2026-41732

CVE-2026-41732...

CVE-2026-59292

CVE-2026-59292...

cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values

cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values...

cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI

cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI...

This Week in Spring - August 18th, 2026

Hi, Spring fans! Welcome back to another edition of This Week in Spring. In my latest video, I dive into how to bake multitenancy into a system using Spring Security, OAuth, and a fantastic third-party project called Arconia. On that note, Arconia also shipped a fresh release that folds in severa...

cve-2026-47882 - LOW - CVE-2026-47882: Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...

cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache

cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache...

cve-2026-40993 - HIGH - Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry

cve-2026-40993 - HIGH - Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry...

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...

A Bootiful Podcast: Hadi Hariri, Jetbrains legend

Hi Spring and Kotlin fans! In this installment, I have the privilege of talking to my old friend and JetBrains legend Hadi Hariri, recorded live from Kotlin Conf 2026 in Munich, Germany! kotlin jvm java springboot...

Self Routing guard bypassed via function composition

Under infinite recursion in the routing layer, request-handling can cause OOM error...

ONNX model cache defaults to world-writable predictable /tmp directory

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Only applications that use TransformersEmbeddingModel and have the cache enabled, using the default location, are affected...

Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore

spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter . When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4j-store , doKey embeds the key into a backtick-delimited Cypher...

A Bootiful Podcast: The legendary Rossen Stoyanchev on API versioning, declarative interface clients, RestTestClients, and more

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In this installment I talk to the legendary Rossen Stoyanchev on API versioning, declarative interface clients, RestTestClients, and more!...

A Bootiful Podcast: The legendary Sébastien Deleuze on all that's new and nice in Spring Framework 7

Hi, Spring fans! Happy Spring Boot 4.0 release day! Make sure to get the bits on the Spring Initializr you know - start.spring.io! This release is packed with new features, a lot of which comes from Spring Framework 7. To help break it down for us this week, we’re joined by none other than the...

A Bootiful Podcast: The Vaadin team, live from Vaadin Create 2025

Hi, Spring fans! In this installment, I had the privilege to sit down with Vaadin legends Joonas Lehtinen, Marcus Hellberg, and Leif Åstrand at the amazing Vaadin Create 2025 event in Frankfurt, Germany...

New Home for Spring Integration AWS

The Spring Integration for AWS was always an independent Spring Integration extension project with its own plans and release cycles. The consumption of this single jar library has always added a complexity from the dependency management perspective. It depends not only on Spring Integration modul...

Multi-Factor Authentication in Spring Security 7

In 2013, it was proposed to add multi-factor authentication into Spring Security. That was the year that “selfie” was added to the English dictionary and “What Does the Fox Say?” was a viral YouTube hit. Needless to say, one of the biggest features in Spring Security 7 is a long time coming, and ...

This Week in Spring - September 16th, 2025

Hi, Spring fans! Welcome to another extra special installment of This Week in Spring , wherein we celebrate a very auspicious day indeed: the release of Java 25 and GraalVM 25! That's right: an incredible new iteration of the JVM has just dropped and with it come a ton of features! Let's go throu...

Connect Your AI to Everything: Spring AI's MCP Boot Starters

The Model Context Protocol MCP standardizes how AI applications interact with external tools and resources. Spring joined the MCP ecosystem early as a key contributor, helping to develop and maintain the official MCP Java SDK that serves as the foundation for Java-based MCP implementations...

A Bootiful Podcast: Purnima Padmanabhan, General Manager, Tanzu Division, Broadcom

Hi, Spring fans! In this installment, we talk to the general manager of Tanzu, the legendary Purnima Padmanabhan, about AI, the power of the platform, and more. Recorded live from SpringOne 2025!...

This Week in Spring - September 9th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I am home, ensconced in my studio here in somewhat sunny San Francisco, California, relaxing and trying to catch up on stuff I missed. As always, there's a ton! So let's dive right into it. Some of the amazing features that...

A Bootiful Podcast: Dr. Heinz Kabutz, a legendary Java Champion, teacher, and author of the Java Specialists newsletter!

Hi, Spring fans! In this installment, I talk to Dr. Heinz Kabutz, a legendary Java Champion, trainer, teacher, and author of the Java Specialists newsletter! This episode was recorded live at Devoxx UK 2025...

Spring Data Ahead of Time Repositories

In the past couple of years we have seen heavy investment throughout the Java ecosystem to reduce application startup times. The main focus gravitates around Ahead-of-Time optimizations. May it be condensing code into a GraalVM native executable, capturing already optimized bytecode with...

Your First Spring AI 1.0 Application

Your First Spring AI 1.0 Application by Dr. Mark Pollack, Christian Tsolov, and Josh Long Hi, Spring fans! Spring AI is live on the Spring Initializr and everywhere fine bytes might be had. Ask your doctor if AI is right for you! It's an amazing time to be a Java and Spring developer. There's nev...

This Week in Spring - October 29th, 2024

Hi, Spring fans! How're things? It's almost Halloween! I'm so excited! I'm going as a PHP program. Boooooooo...t. I'm writing this from the amazing Vaadin Create conference in Frankfurt, Germany, about to do my keynote for an amazing, Spring-loving audience here. So, without further ado, let's di...

Spring Tips: HTMX

Hi, Spring fans! HTMX is the progressive hypertext sensation that's sweeping the process of web app creation, and - thanks to a nice integration by Spring community legend Wim Deblauwe, it's easier than ever to use it with Spring Boot and Thymeleaf. And, it's the topic of today's installment! jav...

A Bootiful Podcast: Microsoft's Sandra Ahlgrimm on cloud, Java, AI, and more

Hi, Spring fans, from the amazing Spring IO conference in Barcelona, Spain! In this interview I talked to Microsoft's Sandra Ahlgrimm on all things cloud, Java, AI, and more. Also, a special and quick discussion with Spring IO founder Sergi Almar, who was last on the show in, I think, 2020!...

Spring Framework URL Parsing with Host Validation (3rd report)

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks. This is the...