935 matches found
This Week in Spring - October 8th, 2024
Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Antwerp, Belgium, for the amazing Devoxx Belgium 2024 event! I am so happy to be back here, one of the best shows in the Java ecosystem! We've got a lot to get into so let's dive right in! From Spring Cloud Data Flow...
From Spring Cloud Data Flow 2.11.x to 3.0
Dear Spring Community, With the recent announcement of Spring Framework 7.0 and Spring Boot 4.0, the Spring Cloud Data Flow team is pleased to announce the next major release, SCDF 3.0, to align with both Spring Framework 7.0 and Spring Boot 4.0. This will bring the following SCDF ecosystem of...
A Bootiful Podcast: Spring creator and cofounder, Dr. Rod Johnson
In this wide-ranging interview, I finally sit down one-on-one and talk to Dr. Rod Johnson, the creator of Spring, entrepreneur, venture capitalist, engineer, father, Kotlin fan, AI researcher, and musician, about this, that, and everything in between, fresh off our recent SpringOne presentation o...
A Bootiful Podcast: Tanzu's Cloud and Spring legend Chris Sterling
Hi, Spring fans! In this installment I talk to the Tanzu legend Chris Sterling, who works on making Spring an even more valuable part of a platform. This episode was recorded live at the epic SpringOne 2024 event!...
A Bootiful Podcast: Digital Accessibility Architect, Java and Groovy legend, Scott Davis
Hi, Spring fans! In this episode I talk to Java ecosystem legend Scott Davis...
A Bootiful Podcast: Cloud Native Cora Iberkleid on architecture, Spring Modulith, and more
Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In today’s episode, I talk to cloud native Cora Iberkleid about the awesome modular sensation that’s sweeping applications, Spring Modulith!...
Arbitrary File Write Vulnerability in Spring Cloud Data Flow
Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to receive upload package requests. However, due to improper sanitization for upload path, a malicious user who has access to skipper server api...
Spring Tips: the Exposed ORM for Kotlin
Hi, Spring fans! In this installment we look at the Exposed Object Relational Mapper framework for Kotlin. Kotlin Java JDBC springboot...
Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticatedAuthentication method. Specifically, an application is vulnerable if: An application...
Spring Tips: easy CQRS with Axon Framework
Hi, Spring fans! In this installment I'm joined by Axon Framework founder Allard Buijze and we look at the new integrations for Spring Boot developers in Axon Framework and AxonIQ Server. Special thanks to AxonIQ for the keynote video replay. Check out for more great stuff! java java21 axon...
A Bootiful Podcast: Trifork CTO Joris Kuipers
Hi, Spring fans! In this installment, Josh Long talks to longtime Spring community legend and Trifork CTO Joris Kuipers. Happy new year!...
A Bootiful Podcast: Microcks.io contributors Laurent Broudoux and Yacine-Kheddache
Hi, Spring fans! In this installment, I talk about the wide world of AI and then discuss microservice testing with Microcks.io contributors and founders Laurent Broudoux and Yacine-Kheddache. This was recorded live from Devoxx BE 2023!...
A Bootiful Podcast: Spring Security lead Rob Winch
Hi, Spring fans! Welcome to another installment of a Bootiful Podcast. In this interview, Josh Long @starbuxman talks to Spring Security legend and lead Rob Winch @robwinch, recorded live from SpringOne 2023!...
A Bootiful Podcast: Microsoft’s Sean Li on Azure and Spring Boot
Hi, Spring fans! In this relatively quick installment, recorded live from the lovely Spring I/O 2023, Josh Long talks to Microsoft's Sean Li about some of the latest and greatest in the Azure ecosystem for Spring developers...
This Week in Spring - May 9th, 2023
Hi, Spring fans! Welcome to another wonderful, fancyful installment of This Week in Spring! I was just at the first Devoxx GR, in the sunny mediterranean city of Athens, Greece. Uh, yah, this was a good'un. If you can get to it, you should. Don't miss next year's installment if you missed this on...
This Week in Spring - May 2, 20223
Hi, Spring fans! Welcome to another installment of This Week in Spring! You realize it's already May, 2023? Time's flying, way too quickly! I just got back from Bangalore, India, where I spoke at the amazing Great International Developer Summit, one of the all time best shows ever, and now I'm...
Potential Unintended Data Exposure for Resource Exposed by Spring Data REST
Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...
A Bootiful Podcast: Nate Schutta: The Thinking Person's Architect, My Friend, and Teammate
Hi, Spring fans! In this installment, Josh Long @starbuxman talks to his friend, teammate, and architect extraordinaire, Nate Schutta @ntschutta...
Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized. Specifically, an application is vulnerable when all of the...
BCrypt skips salt rounds for work factor of 31
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor 31, the encoder does not perform any salt rounds, due to an integer overflow error. The default...
Authorization Bypass During JWT Issuer Validation with spring-security
Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWT...
JSONP enabled by default in MappingJackson2JsonView
Spring Framework, versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions, allows web applications to enable cross-domain requests via JSONP JSON with Padding through AbstractJsonpResponseBodyAdvice for REST controllers, and MappingJackson2JsonView for browse...
Unauthorized Access with Spring Security Method Security
Spring Security in combination with Spring Framework 5.0.5.RELEASE contain an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...
Issuer validation regression in Spring Cloud SSO Connector
Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...
Spring Batch Admin vulnerable to Cross Site Request Forgery
Spring Batch Admin does not contain Cross Site Request Forgery CSRF protection, which may allow an attacker to craft a malicious site that executes requests to Spring Batch Admin...
Directory Traversal in the Spring Framework ResourceServlet
Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks...
Spring Security / MVC Path Matching Inconsistency
Both Spring Security and the Spring Framework rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Securit...
cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache
cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache...
cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator
cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator...
cve-2026-41732 - HIGH - In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization
cve-2026-41732 - HIGH - In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization...
cve-2026-41730 - MEDIUM - Spring Data REST exposes persistence-layer internals in error responses
cve-2026-41730 - MEDIUM - Spring Data REST exposes persistence-layer internals in error responses...
CVE-2026-41842: Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux
Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can send malicious requests that are slow to...
cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service
cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service...
This Week in Spring - May 19th, 2026
Hi Spring fans! Welcome to another installment of This Week in Spring!, this one written from the back of a taxi racing to the local Frankfurt train station, where I'll take a train to Munich for the amazing Kotlin Conf 2026 edition, where I'll be part of the keynote and deliver a talk on the...
ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...
Ronald Dehuysser, founder of JobRunr, on their ambitious new JavaClaw-like agent runtime
Hi Spring fans! In this installment, I talk to my friend and JobRunr founder Ronald Dehuysser about the latest and greatest, and their new "JavaClaw" project!...
OOM by attacker-controlled PDF
In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper . Only applications that use ForkPDFLayoutTextStripper and pass user-supplied input to DocumentReader s are affected...
ONNX model cache defaults to world-writable predictable /tmp directory
In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Only applications that use TransformersEmbeddingModel and have the cache enabled, using the default location, are affected...
Cassandra SSL auto-configuration disables TLS hostname verification
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra...
Random value property source uses a weak PRNG unsuitable for secrets
Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range...
Default security filter chain has no authorization rule with Actuator but without Health
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: If any of the above does not apply, the application is not vulnerable...
Servlet Path Not Correctly Included in Path Matching of XML Authorization Rules
If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass...
Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
If an application is using securityMatchersString and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security components will not be exercised as intended by the application. This can lead to the authentication,...
Spring Office Hours Podcast: S5E13 - Community Potluck
Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this Potluck episode, Dan and DaShaun open up the floor to the community, answering your questions on Spring Boot, Spring AI, Spring Security, and whatever else is on your mind. Potluck episodes are shaped...
Spring Office Hours Podcast: S5E12 - Developer Soft Skills with Arun Gupta
Join Dan Vega and DaShaun Carter for another essential update from the Spring ecosystem. In this episode, the guys are joined by DevRel and Java legend Arun Gupta to discuss a topic often overlooked but vital for career longevity: soft skills for developers. Drawing from his decades of experience...
SSL bundle configuration silently bypassed in Spring Cloud Gateway
When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle , the configuration was silently ignored and the default SSL configuration was used instead...
A Bootiful Podcast: Java developer advocate Ana-Maria Mihalceanu
I had a wonderful chat with Java Developer Advocate Ana-Maria Mihalceanu about Java Flight Recorder, Project Babylon, Project Panama, and so many other exciting things in the Java ecosystem...
RediSearch Query via Unescaped TAG Filter Values in RedisVectorStore
In RedisFilterExpressionConverter of spring-ai-redis-store , when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters...
Blending Chat with Rich UIs with Spring AI and MCP Apps
The way humans typically interact with AI is via a chat-style interface such as ChatGPT or Claude Desktop. In fact, the ability to converse with an AI in natural language is perhaps one of the most amazing things about this technology. It lets humans talk to computers in human terms, rather than...
This Week in Spring - January 26th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this, I cannot believe we're nearly at the end of the month! Time sure flies. Spring AI 2.0.0-M2 is available now Spring Modulith 2.1 M1, 2.0.2, and 1.4.7 released In last week's installment of A Bootiful Podcast ,...