Spring Session 2022.0.0-M3 Released

On behalf of the team, I’m pleased to announce the release of Spring Session 2022.0.0-M3. These releases deliver, enhancements, bug fixes, and dependency upgrades. For your convenience, Spring Boot will pick up these artifacts with its upcoming releases. The following modules were updated as part...

A Bootiful Podcast: Hashicorp's Rosemary Wang on securing the intersection of apps and ops with Hashicorp Vault

Hi, Spring fans! In this episode Josh Long @starbuxman talks to Hashicorp Developer Advocate Rosemary Wang @joatmon08 about a few Hashicorp technologies and their integrations with Spring Boot...

A Bootiful Podcast: Spring I/O founder, Spring trainer and community legend Sergi Almar

Hi, Spring fans! At long last, against all odds, Josh Long @starbuxman finally gets to talk to Spring I/O founder and more-than-a-decade-long friend Sergi Almar @sergialmar about an edition of Spring I/O after 2019!...

Spring Cloud Azure 4.0 is Now Generally Available

NOTE: Hi, Spring fans! This is a guest post from Sean Li, our friend at Microsoft I am pleased to announce that Spring Cloud Azure 4.0 is now generally available. With this major release we aim to bring better security, leaner dependencies, support for production readiness and more. Version 4...

Remote Code Execution with spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.3 and 2.2 prior to 2.2.2 and 2.1 prior to 2.1.2 and 2.0 prior to 2.0.15 and older unsupported versions, contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint th...

Unauthorized Access with Spring Security Method Security

Spring Security in combination with Spring Framework 5.0.5.RELEASE contain an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

Insufficiently random session id in Java SockJS client

Session id generation in the Java SockJS client is not sufficiently secure and could allow a user to send messages to another user’s session. Note that this only affects users of the Java SockJS client, which generates its own session id. It does not affect browser clients even if they’re...

A Bootiful Podcast: Russ Miles on Safer, More Productive Interactions with AI

I’m joined, I think, for the second time by my friend, the legendary architect and developer extraordinaire Russ Miles, who has given some of the most cerebral and exciting Spring keynotes and talks ever. And this time, he’s back to talk about — guess what — A.I. As usual, he’s got a different an...

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability...

cve-2026-40992 - MEDIUM - Mail Auto-Configuration Does Not Enable SSL Hostname Verification

cve-2026-40992 - MEDIUM - Mail Auto-Configuration Does Not Enable SSL Hostname Verification...

cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache

cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache...

cve-2026-40997 - MEDIUM - SOAP security faults leak Spring Security account state

cve-2026-40997 - MEDIUM - SOAP security faults leak Spring Security account state...

cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator...

cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys...

cve-2026-41731 - HIGH - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

cve-2026-41731 - HIGH - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization...

VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId . Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input ...

Elasticsearch auto-configuration with an SSL bundle disables TLS hostname verification

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server...

A Bootiful Podcast: A Bootiful Podcast: Dr. Venkat Subramaniam and James Ward on Intelligent Kotlin and So Much More

I am beyond thrilled that I got to co-present with two legends, Dr. Venkat Subramaniam and James Ward, at Voxxed Days Amsterdam, and even more so that they both sat down for a quick discussion with me right before that presentation. Enjoy!...

Servlet Path Not Correctly Included in Path Matching of XML Authorization Rules

If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass...

Blending Chat with Rich UIs with Spring AI and MCP Apps

The way humans typically interact with AI is via a chat-style interface such as ChatGPT or Claude Desktop. In fact, the ability to converse with an AI in natural language is perhaps one of the most amazing things about this technology. It lets humans talk to computers in human terms, rather than...

A Bootiful Podcast: Jonatan Ivanov on how to measure all the things with Micrometer

Hi, Spring fans! This week we catch up with the observably awesome Jonatan Ivanov on how to measure all the things with Micrometer...

Null-safe applications with Spring Boot 4

This is a new blog post in the Road to GA series, this time sharing an update on the status of the null-safety support across the Spring portfolio, as a follow-up of my previous related blog post Null Safety in Spring applications with JSpecify and NullAway and related Spring I/O talk. Are we...

This Week in Spring - October 14th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Boston and New York city and Bulgaria and Poland this week, but I'm still hyped about last week's amazing Devoxx Belgium event! There are a ton of videos to look at, and I'll include just some of them here. So, without...

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true:...

A Bootiful Podcast: DevOps and AI luminary Patrick Debois

Hi, Spring, cloud native, and AI fans! In this installment, I had the opportunity to briefly sit down and talk with DevOps and AI luminary Patrick Debois, from the amazing Devoxx UK 2025 show...

A Bootiful Podcast: Spring IO founder Sergi Almar on Spring IO 2025

Hi, Spring and Spring I/O fans! In this installment we have the privilege of chatting with friend of the community and legend Sergi Almar about the amazing Spring IO 2025, where this episode was published, and a lot more...

Spring Security BCryptPasswordEncoder maximum password length breaks timing attack mitigation

The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider...

A Bootiful Podcast: My friend Anthony Dahanne on Buildpacks, Production, Docker images, and more

Salut fans de Spring! In this installment I'm joined by the legendary Anthony Dahanne. If you've enjoyed success in production using Spring's built-in spring-boot:build-image capability, you've got today's guest Anthony to thank for it!...

From Spring Framework 6.2 to 7.0

Dear Spring community, Spring Framework 6.2 is shaping up for general availability in November 2024, with particularly significant revisions in the core container and in our web support: see "What's New in Spring Framework 6.2". This release is designed for use with JDK 17-23 and Jakarta EE 9-10...

This Week in Spring - June 18th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! I've just come from Paris, France, and now I'm in equally beautiful Krakow, Poland, for the amazing Devoxx PL event. We've got a ton of good stuff to dive into, so let's get going! In last week's installment of Spring Tips, I...

A Bootiful Podcast: Spring founders Rod Johnson and Juergen Hoeller on the 20th Anniversary of Spring Framework 1.0

Hi, Spring fans! In this episode, more than 20 incredible years in the making, Spring founders Rod Johnson @springrod and Juergen Hoeller @springjuergen discuss Spring since its 1.0 release in 2004...

Spring Tips: the Spring Expression Language

Hi, Spring fans! In this installment, I look at the excellent Spring Expression Language, an embedded language for resolving simple expressions that is built right into the Spring Framework...

This Week in Spring - December 19th, 2023

Hi, Spring fans! Welcome to another oh-so-festive edition of This Week in Spring! the Spring Authorization Server 1.2.1, 1.1.14, and 0.4.5, are now available Spring AMQP 3.1.1 is now available Spring Security 5.8.9, 6.1.6, 6.2.1 are now available Spring for Apache Kakfa 3.1.1 is now available...

A Bootiful Podcast: GraalVM founder and Oracle vice president Thomas Wuerthinger

Hi, Spring fans! In this installment Josh Long talks to Oracle vice president Thomas Wuerthinger about the project he created and leads, GraalVM. This was recorded live from Devoxx Belgium 2023!...

This Week in Spring - August 1st, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! Can you believe it's already August 1, 2023??? Me either. As I write this, I'm preparing some of my contributions for SpringOne at VMWare Explore 2023, happening next month in lovely Las Vegas, NV. Have you registered yet? I'...

A Bootiful Podcast: Micrometer lead Tommy Ludwig

Hi, Spring fans! In this installment, Josh Long talks to Micrometer lead Tommy Ludwig, recorded from beautiful Barcelona, Spain during the fabulous Spring I/O event!...

A Bootiful Podcast: Spring Boot team member Moritz Halbritter (@m_halbritter)

Hi, Spring fans! In this installment Josh Long YouTube.com/@coffeesoftware.com talks to Spring Boot team member Moritz Halbritter @mhalbritter...

A Bootiful Podcast: Grubhub's Josh Burns on Kotlin, Spring Boot, and more

We're crossing the streams, again! This time Josh Long talks to Grubhub's John Burns twitter: @wakingrufus mastodon: @[email protected] about dogfooding human food, Grubhub's tech stack, and more...

Spring Framework Reference Documentation Update

Starting with version 6.0.9, the Spring Framework reference documentation site is generated with Antora. This is a big change that brings many improvements. This blog post provides context around that. Overview For a long time the Spring Framework reference documentation had two versions, one...

A Bootiful Podcast: James Ward, Kotlin Product Manager at Google

Hi, Spring fans! In this installment Josh Long talks to James Ward, Kotlin Product Manager at Google...

A Bootiful Podcast: Sonatype's Steve Poole and Gradle's Justin Reock on Improving Developer Productivity without compromising on things like security

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In this installment, recorded at Devnexus in Atlanta, GA, I talk to newcomer to the show Steve Poole, from Sonatype, and Justin Reock, from Gradle, about improving developer productivity without comprising on things like...

Spring Data JPA introduces query parser!

The Problem One of Spring Data JPA’s handy features is letting you plugin in custom JPA queries through its @Query annotation. This allows some flexiblity because you are still able to offer sort parameters to the consumers of your app. Check out the example below: interface SampleRepository...

A Bootiful Podcast: Google Cloud Java Advocate Aaron Wanjala

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Google Cloud Java advocate Aaron Wanjala @ AaronMDubya about Spring Framework for Google Cloud...

This Week in Spring - February 28th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm writing this installment from a hotel room in Dallas, Texas, in the USA. Last night I had the privilege of hanging out with some of my friends from the local Java scene. Today I meet with customers. It's going to be a nic...

A Bootiful Podcast: It's Glenn Renfro! Listen to this episode if you want to feel better

Hi, Spring fans! Today Josh Long @starbuxman talks to Atlanta JUG, Devnexus, Spring Cloud Task, Spring Integration, Spring Cloud Dataflow luminary, and the living embodiment of the word "joy:" Glenn Renfro @cppwfs Watch the podcast in living color on Youtube!...

A Bootiful Podcast: GraalVM advocate Alina Yurenko on a Bootiful Podcast

Liiiive from New York, its a Bootiful Podcast! This week I @starbuxman talk to Developer Advocate for GraalVM at Oracle Labs, and legend, Alina Yurenko @alinayurenko...

This Week in Spring - November 15th, 2022

Hi, Spring fans! Howre you doin this fine Tuesday morning? Ive returned home to San Francisco and am up and at em nice and early to catch a flight to Seattle, where Ill speak at the Java User Group tonight. If youre in Seattle, dont miss it! Weve got a ton of cool stuff to get into this week, but...

A Bootiful Podcast: Java Champion, legend, and prolific open source contributor Andres Almiray

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Java Champion, legend, and prolific opensource contributor Andres Almiray @aalmiray...

Learn more about Spring Framework 6 and Spring Boot 3 in these two great talks from Devoxx 2022

Hi, Spring fans! I was just at Devoxx in Belgium, where hundreds of experts from across the Java ecosystem converged for the first time since 2019 to deliver their biggest and best. I could do a proper trip report, but I really just came here to point you to two talks from two of my amazing...

A Bootiful Podcast: Spring and Java community legend Marten Deinum

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to longtime Spring community member and legend Marten Deinum @mdeinum about scuba diving, software, Spring, community, and more. Also: I fixed the odd silence in the middle of the last few episodes! thanks for suffering through it...