1038 matches found
A Bootiful Podcast: Java Champion, legend, and prolific open source contributor Andres Almiray
Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Java Champion, legend, and prolific opensource contributor Andres Almiray @aalmiray...
Learn more about Spring Framework 6 and Spring Boot 3 in these two great talks from Devoxx 2022
Hi, Spring fans! I was just at Devoxx in Belgium, where hundreds of experts from across the Java ecosystem converged for the first time since 2019 to deliver their biggest and best. I could do a proper trip report, but I really just came here to point you to two talks from two of my amazing...
A Bootiful Podcast: Spring and Java community legend Marten Deinum
Hi, Spring fans! In this installment, Josh Long @starbuxman talks to longtime Spring community member and legend Marten Deinum @mdeinum about scuba diving, software, Spring, community, and more. Also: I fixed the odd silence in the middle of the last few episodes! thanks for suffering through it...
Delete Passwords: Passwordless Connections for Spring Boot Apps to Azure Services
Using username/password credentials to access one application from another presents a huge security risk for many reasons. Today, we are announcing the preview of passwordless connections for Java applications to Azure database and eventing services, letting you finally shift away from using...
A Bootiful Podcast: Couchbase and Cloud legend Laurent Doguin
Hi, Spring fans! In this installment, Josh Long @starbuxman talks to his friend, fellow Java Champion, and director of developer relations and strategy at Couchbase, Laurent Doguin @ldoguin SpringOne 2022 is almost here! This is our first in-person event since the pandemic and its when we release...
Bootiful Podcast: Spring Framework contributor Sébastien Deleuze on GraalVM, AOT, project Leyden, and WebAssembly
Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Spring Framework contributor Sébastien Deleuze @sdeleuze on GraalVM, AOT, project Leyden, and WebAssembly...
BCrypt skips salt rounds for work factor of 31
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...
RCE in PATCH requests in Spring Data REST
Malicious PATCH requests submitted to servers using Spring Data REST backed HTTP resources can use specially crafted JSON data to run arbitrary Java code...
RFD Attack in Spring Framework
Under some situations, the Spring Framework is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the...
XSS when using Spring MVC
When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form...
This Week in Spring - August 25th, 2026
Hi, Spring fans! Welcome back to another installment of This Week in Spring. It’s a big week ahead: I’m about to head out on a packed tour through Europe—Wrocław for a friend’s wedding, Oslo for JavaZone, Paris for a Spring meetup details coming soon, Amsterdam for IntelliJ IDEA conf—and then on ...
CVE-2026-41732
CVE-2026-41732...
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...
cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File...
cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint
cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization...
cve-2026-59281 - MEDIUM - Spring Framework Cross-site Scripting via EscapedErrors
cve-2026-59281 - MEDIUM - Spring Framework Cross-site Scripting via EscapedErrors...
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...
This Week in Spring - June 16th, 2026
Hi Spring fans! Welcome to another installment of This Week in Spring! I'm writing this from the oh-so-delightful and delicious! city of New Delhi, India. It's been a real privilege to come and visit so many amazing people. Last night my friend DaShaun and I presented here at the local Delhi JUG,...
cve-2026-41003 - HIGH - Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
cve-2026-41003 - HIGH - Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting...
cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution
cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution...
This Week in Spring - June 9th, 2026
Hi Spring fans! Welcome to another installment of This Week in Spring! Tons of releases coming out today and this week! So make sure you're pulling in the latest posts, as often as possible! Spring LDAP 2026.06 Releases - Contains CVE Fix Spring Framework 7.0.8 and 6.2.19 Available Now Spring...
cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service
cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service...
cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP
cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...
Self Routing guard bypassed via function composition
Under infinite recursion in the routing layer, request-handling can cause OOM error...
Spring gRPC AuthenticationException message reflected to remote client
The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks...
ONNX model cache defaults to world-writable predictable /tmp directory
In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Only applications that use TransformersEmbeddingModel and have the cache enabled, using the default location, are affected...
Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
If an application is using securityMatchersString and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication,...
A Bootiful Podcast: Daniel Garnier-Moiroux on MCP Security
Hi Spring, AI, Spring AI, security, and Spring Security fans! In this installment I talk to the legendary Daniel-Garnier Moiroux! ai mcp security java...
A Bootiful Podcast: Cay Horstmaan, legendary Java professor, author, lecturer
Hi, Spring fans! In this installment, we talk to the legendary Java author, professor, and Java Champion Cay Horstmann, whom you might know from classics such as "Core Java." his web site And of course even the most cursory search will land you at his books... javaone java...
This Week in Spring - January 6th, 2026
Hi, Spring fans, to the first installment of This Week in Spring in the new year and , roughly, the fifteenth anniversary edition of this series! I've been writing these blogs since the first week of January of 2011, and I am proud to say that I haven't so far missed a single week! I've always...
A Bootiful Podcast: The Vaadin team, live from Vaadin Create 2025
Hi, Spring fans! In this installment, I had the privilege to sit down with Vaadin legends Joonas Lehtinen, Marcus Hellberg, and Leif Åstrand at the amazing Vaadin Create 2025 event in Frankfurt, Germany...
This Week in Spring: September 30th, 2025
Hi, Spring fans! As I write this I am about to board a flight for Colorado for the amazing Dev2Next conference! I'll be in Antwerp, Beglium for the amazing Devoxx event next week, and I'll be speaking at the Amsterdam JUG with James Ward on the Thursday after that, too! If you're around, be sure ...
This Week in Spring - September 9th, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring! I am home, ensconced in my studio here in somewhat sunny San Francisco, California, relaxing and trying to catch up on stuff I missed. As always, there's a ton! So let's dive right into it. Some of the amazing features that...
A Bootiful Podcast: Spring Cloud guru Ryan Baxter
Hi, Spring fans! In this installment we talk to the amazing Spring Cloud contributor Ryan Baxter, live from SpringOne 2025!...
This Week in Spring - June 24th, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring! We're in the middle of June already! And you know what that means? Warm weather, fun, and of course: the amazing SpringOne event in lovely Las Vegas, NV! The content catalog went live today! I'll be there doing, among other...
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies...
Spring Data Ahead of Time Repositories
In the past couple of years we have seen heavy investment throughout the Java ecosystem to reduce application startup times. The main focus gravitates around Ahead-of-Time optimizations. May it be condensing code into a GraalVM native executable, capturing already optimized bytecode with...
A Bootiful Podcast: V Körbes on security from the platform on up
Hi, Spring fans! In today's extra special installment I talk to Broadcom's V Körbes who works on security above and below the application...
A Bootiful Podcast: AWS Developer Advocate and industry legend James Ward
Hi, Spring fans! In this installment I talk to AWS Developer Advocate and industry legend James Ward about AWS Bedrock, Amazon Cohere, Spring AI, MCP, and so much more!...
Spring Security authorization bypass for method security annotations on parameterized types
Spring Security may not correctly locate method security annotations on parameterized types or methods. This may cause an authorization bypass. Your application may be affected by this if the following are true: In that case, the target method may be able to be invoked without proper authorizatio...
A Bootiful Podcast: the amazing K. Siva Prasad Reddy (SivaLabs)
Hi, Spring fans! In today's installment I talk to industry legend K. Siva Prasad Reddy @sivalabs. You've probably read one of his blogs. I know I have!...
This Week in Spring - September 10th, 2024
Hi, Spring fans! Or, I suppose: 안녕하세요, Spring 팬 여러분! I'm writing this from a café in scintillating Seoul, Korea. It's amazing. I've been talking to developers of all stripes who are using and building upon Spring to do all sorts of cool stuff. And tomorrow, it's off to jolly Japan. I'll be...
Spring Framework DoS via conditional HTTP request
Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack...
A Bootiful Podcast: Observability legend Jonatan Ivanov on the latest and greatest in Micrometer
Hi, Spring fans! In this installment we talk to observability legend Jonatan Ivanov about the latest and greatest in the wide and wonderful world of observability. Turns out a library that's used by countless projects including and beyond the Spring ecosystem keeps quite busy!...
This Week in Spring - July 23rd, 2024
Hi, Spring fans! It's such an exciting time to be alive! I hope you're doing well. It's nearly the end of July, already! Time is flying and as always the community has not disappointed with their incredible content. Let's dive right into it! have you registered for SpringOne 2024 yet? I love this...
Spring Tips: Proxies
Hi, Spring fans! In this installment we look at the use of JDK and CGLIB-based proxies in Spring, and demystify their application Java SpringBoot SpringFramework Architecture DesignPatterns oop...
Spring Tips: Testcontainers, Docker Compose, and Service Connections, oh my
Hi, Spring fans! In this installment, we look at the amazing service connection mechanism in Spring Boot. Service connections are what allow Spring Boot to connect to Testcontainers or Docker Compose containers for supporting infrastructure like SQL databases, middleare, and more. java...
Arbitrary File Write Vulnerability in Spring Cloud Data Flow
Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to receive upload package requests. However, due to improper sanitization for upload path, a malicious user who has access to skipper server api...