A Bootiful Podcast: iText Creator Bruno Lowagie

Hi, Spring fans! We're releasing Spring Boot 3.2 today! And it's Thanksgiving in the USA Happy Thanksgiving!. So, we wanted to celebrate with an amazing episode, and so today's guest is opensource legend Bruno Lowagie. Enjoy!...

A Bootiful Podcast: Azul Deputy CTO Simon Ritter

Hi, Spring fans! In this week's installment I talk to Azul Deputy CTO Simon Ritter @speakjava, recorded live at Devoxx Belgium 2023!...

A Bootiful Podcast: Spring Security and Kubernetes legend Daniel Garnier-Moiroux

Hi, Spring fans! In this installment Josh Long talks to Spring contributor and adjunct professor at Mines Paris, Daniel Garnier-Moiroux @kehrlann, about the wild and wonderful intersection of all things Spring Security and Kubernetes, productized Spring Cloud Services, and more, recorded live at...

A Bootiful Podcast: Spring team legend Dr. David Syer on view rendering technologies, the latest-and-greatest, SpringOne 2023, and more

Hi, Spring fans! In this installment Josh Long talks to the legendary Dr. David Syer about view rendering technologies, SpringOne, and more. Have you registered for SpringOne yet? Are you interested in learning Spring? Check out Spring Academy...

Docker Compose Support in Spring Boot 3.1

Docker Compose support in Spring Boot 3.1 builds on top of the ConnectionDetails abstraction, which we've featured in a separate blog post. If you haven't already read it, please do so before reading this post. Docker Compose "is a tool for defining and running multi-container Docker applications...

A Bootiful Podcast: Sebastien Deleuze and James Ward on a Bootiful Podcast

Hi, Spring fans! In this installment, recorded live from Kotlin Conf 2023 in Amsterdam, I talk to Kotlin luminaries Sébastien Deleuze and James Ward about Kotlin's future, web assembly, and more...

This Week in Spring - March 28th, 202

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm reporting to you from Los Angeles, where my family and I have gone for my daughter's spring break. We're going to survey some prospective colleges and we're going to Disneyland. Needless to say, I'm doubly glad to have al...

A Bootiful Podcast: opensource, Spring Cloud, and Kubernetes maestro Abel Salgado Romero

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Abel Salgado Romero @abelsromero about open source, Kubernetes, and building Kubernetes controllers with Spring Boot and GraalVM native images...

A Bootiful Podcast: Dr. Amanda Martin, Gradle developer advocate

Hi, Spring fans! In this installment, Josh Long @starbuxman talks with Gradle developer advocate Dr. Amanda Martin @DrAmandaLMartin...

This Week in Spring - January 17th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! I went to Helsinki, Finland, last week, and this week I'm in Atlanta, Georgia, to speak at the Atlanta Java User Group. And, of course, next week, I'll be in New York to join a viewing party for the airing of SpringOne...

A Bootiful Podcast: Field CTO and Chief Evangelist at Gradle Justin Reock

Hi, Spring fans and happy holidays!! In this installment, Josh Long talks to Field CTO and Chief Evangelist at Gradle Justin Reock...

Potential Unintended Data Exposure for Resource Exposed by Spring Data REST

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

A Bootiful Podcast: Observability guru Jonatan Ivanov on the future of observability in Spring Boot

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Spring observability guru Jonatan Ivanov @jonatanivanov...

Spring Tips: Brave, Bold, and Boring YugabyteDB

Hi, Spring fans! In this installment we dare to be boring with YugabyteDB, a distributed database that just works. Its a database that feels like PostgreSQL but scales like Apache Cassandra...

Remote Code Execution with spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.3 and 2.2 prior to 2.2.2 and 2.1 prior to 2.1.2 and 2.0 prior to 2.0.15 and older unsupported versions, contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint th...

Unauthorized Access with Spring Security Method Security

Spring Security in combination with Spring Framework 5.0.5.RELEASE contain an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted...

Directory Traversal in the Spring Framework ResourceServlet

Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks...

XSS when using Spring MVC

When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form...

A Bootiful Podcast: Sébastien Deleuze on the latest-and-greatest in Spring AI and Spring Framework

Hi Spring fans! In this installment we talk to the legendary Spring AI and Spring Framework contributor Sébastien Deleuze about the latest-and-greatest in AI, Kotlin, the framework, and more...

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability...

cve-2026-40992 - MEDIUM - Mail Auto-Configuration Does Not Enable SSL Hostname Verification

cve-2026-40992 - MEDIUM - Mail Auto-Configuration Does Not Enable SSL Hostname Verification...

cve-2026-40997 - MEDIUM - SOAP security faults leak Spring Security account state

cve-2026-40997 - MEDIUM - SOAP security faults leak Spring Security account state...

cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution

cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution...

cve-2026-41731 - HIGH - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

cve-2026-41731 - HIGH - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization...

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...

A Bootiful Podcast: Microsoft's Martijn Verburg

Hi Spring fans! In this installment, I talk to my friend from JClarity and Microsoft fame, fellow Java champion, and Java guru Martijn Verburg ai microsoft java jclarity performance...

A Bootiful Podcast: Hadi Hariri, Jetbrains legend

Hi Spring and Kotlin fans! In this installment, I have the privilege of talking to my old friend and JetBrains legend Hadi Hariri, recorded live from Kotlin Conf 2026 in Munich, Germany! kotlin jvm java springboot...

ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

Unbounded cache for function definitions

OOM error is possible while attempting to add infinite amount of functions to Function Registry...

Ronald Dehuysser, founder of JobRunr, on their ambitious new JavaClaw-like agent runtime

Hi Spring fans! In this installment, I talk to my friend and JobRunr founder Ronald Dehuysser about the latest and greatest, and their new "JavaClaw" project!...

VectorStore FilterExpression Converter injection

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Only applications that use...

VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId . Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input ...

Elasticsearch auto-configuration with an SSL bundle disables TLS hostname verification

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server...

Servlet Path Not Correctly Included in Path Matching of XML Authorization Rules

If an application uses to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass...

SSL bundle configuration silently bypassed in Spring Cloud Gateway

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle , the configuration was silently ignored and the default SSL configuration was used instead...

RediSearch Query via Unescaped TAG Filter Values in RedisVectorStore

In RedisFilterExpressionConverter of spring-ai-redis-store , when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters...

Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore

spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter . When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4j-store , doKey embeds the key into a backtick-delimited Cypher...

This Week in Spring - March 10th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring. As I write this, I am preparing for a trip to Rust, Germany, for one of the best Java conferences in Europe: JavaLand, along with its new companion event, DevLand. It should be fun. Will you be around? If so, say hi. We have ...

Spring AI Agentic Patterns (Part 4): Subagent Orchestration

Instead of one generalist agent doing everything, delegate to specialized agents. This keeps context windows focused—preventing the clutter that degrades performance. Task tool, part of the spring-ai-agent-utils toolkit, is a portable, model-agnostic Spring AI implementation inspired by Claude...

This Week in Spring - January 6th, 2026

Hi, Spring fans, to the first installment of This Week in Spring in the new year and , roughly, the fifteenth anniversary edition of this series! I've been writing these blogs since the first week of January of 2011, and I am proud to say that I haven't so far missed a single week! I've always...

A Bootiful Podcast: Oracle VP and GraalVM founder Thomas Wuerthinger

Hi, Spring fans! In this installment I talk to Oracle VP and GraalVM founder Thomas Wuerthinger, recorded at Devoxx 2025!...

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true:...

This Week in Spring - July 29th, 2025

It's the end of July! JULY! The seventh month of the year, done and dusted! AHHHHH! I've got memories of being on a tropical beach over the winter holidays, sipping rum and dodging mosquitoes like I was doing a rhythmic gymnastics routine just recently. It turns out that was seven months ago, not...

A Bootiful Podcast: API oracle Arjen Poutsma

Hi, Spring fans! In this edition, I had the pleasure of chatting with the brilliant Arjen Poutsma, our go-to API oracle. If you’re curious about his fantastic insights, thoughts, and consultancy services, be sure to check out poutsma-principles.com...

This Week in Spring - July 8th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I write this having spent a wonderful week in paradise Bora Bora, French Polynesia, to be precise with my partner Tam Mie. We were so very sad to have to say goodbye. But that means I'm officially back at my desk, with nary a...

A Bootiful Podcast: DevOps and AI luminary Patrick Debois

Hi, Spring, cloud native, and AI fans! In this installment, I had the opportunity to briefly sit down and talk with DevOps and AI luminary Patrick Debois, from the amazing Devoxx UK 2025 show...

Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: In this case the SessionManager persists the first token it retrieves and will continue to use that...

A Bootiful Podcast: My friend Anthony Dahanne on Buildpacks, Production, Docker images, and more

Salut fans de Spring! In this installment I'm joined by the legendary Anthony Dahanne. If you've enjoyed success in production using Spring's built-in spring-boot:build-image capability, you've got today's guest Anthony to thank for it!...

This Week in Spring - February 25th, 2025

Hi, Spring fans, and welcome to another rip-roarin' installment of This Week in Spring! Later today I'll board a plane for magnificent Montreal, Canada for the amazing Confoo conference! I'm super excited! Good news everybody! Spring Boot 3.5.0-M2 is now available! In last week's installment of t...

Extending Spring Data Repositories Just Got Easier

Since its inception, Spring Data Repositories have been designed for extension, whether you want to customize a single query method or provide a completely new base implementation. The 2024.1 release enhances your ability to extend a repository with custom functionality making it easier than ever...