Spring Tips: Spring AI

Hi, Spring fans! In this installment we'll look at the new Spring AI project, which provides convenient integrations with LLMs like the one behind ChatGPT and tools to support the RAG retrieval augmented generation pipeline. ai springboot artificialintelligence java graalvm cloud java21 postgresq...

local information disclosure via temporary directory created with unsafe permissions

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in...

This Week in Spring - December 19th, 2023

Hi, Spring fans! Welcome to another oh-so-festive edition of This Week in Spring! the Spring Authorization Server 1.2.1, 1.1.14, and 0.4.5, are now available Spring AMQP 3.1.1 is now available Spring Security 5.8.9, 6.1.6, 6.2.1 are now available Spring for Apache Kakfa 3.1.1 is now available...

A Bootiful Podcast: GraalVM founder and Oracle vice president Thomas Wuerthinger

Hi, Spring fans! In this installment Josh Long talks to Oracle vice president Thomas Wuerthinger about the project he created and leads, GraalVM. This was recorded live from Devoxx Belgium 2023!...

This Week in Spring - October 31st, 2023

Hi Spring fans, and Happy Halloween from the Spring team to those who celebrate! I hope your evening is fun and your day free of scary bugs! My friends, we've got some interesting stuff to look at this week so let's dive right into it. A Bootiful Podcast: Mr. Spring in Action, Craig Walls Spring...

A Bootiful Podcast: Jetbrains' Anton Arhipov on IntelliJ, Java, and so much more

Hi, Spring fans! Welcome to another installment of A Bootiful Podcast! This week Josh Long talks to Jetbrain's developer advocate Anton Arhipov, recorded live from the amazing Spring IO show in Barcelona, Spain!...

A Bootiful Podcast: Java Champion Ken Kousen on Gradle, Java, Kotlin, Mockito, and more

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Java Champion Ken Kousen @kenkousen, live from the Great International Developer Summit 2023 in beautiful Bangalore, India, about Gradle, the Kotlin DSL, Java, and so much more Check out Ken's awesome Youtube channel...

Building Native Images with GraalVM and Spring Native on Apple's M1 Architecture

It finally happened! They did it! They did it just in time for me to get on the road and start building applications on the road with my shiny new laptop, too! JOY!! Oracle and the GraalVM team released GraalVM and the GraalVM native image capability for Apple M1! Ive been waiting for this day fo...

Spring Cloud Gateway HTTP2 Insecure TrustManager

Applications using Spring Cloud Gateway that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...

Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can...

Authorization Bypass During JWT Issuer Validation with spring-security

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWT...

Spring Batch Admin vulnerable to Cross Site Request Forgery

Spring Batch Admin does not contain Cross Site Request Forgery CSRF protection, which may allow an attacker to craft a malicious site that executes requests to Spring Batch Admin...

Directory Traversal in the Spring Framework ResourceServlet

Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks...

Remote Code Execution (RCE) in Spring Security OAuth

When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

CVE-2026-59321

CVE-2026-59321...

CVE-2026-59286

CVE-2026-59286...

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...

cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse

cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse...

cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around...

cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler

cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...

cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names...

cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies

cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies...

cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader

cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader...

cve-2026-59275 - MEDIUM - Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

cve-2026-59275 - MEDIUM - Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit99...

cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC

cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC...

cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions...

cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution

cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution...

cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider

cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider...

Unauthorized User Impersonation when Using X.509 Client Certificates

SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...

A Bootiful Podcast: Cay Horstmaan, legendary Java professor, author, lecturer

Hi, Spring fans! In this installment, we talk to the legendary Java author, professor, and Java Champion Cay Horstmann, whom you might know from classics such as "Core Java." his web site And of course even the most cursory search will land you at his books... javaone java...

A Bootiful Podcast: Jonatan Ivanov on how to measure all the things with Micrometer

Hi, Spring fans! This week we catch up with the observably awesome Jonatan Ivanov on how to measure all the things with Micrometer...

Smart Tool Selection: Achieving 34-64% Token Savings with Spring AI's Dynamic Tool Discovery

As AI agents connect to more services—Slack, GitHub, Jira, MCP servers—tool libraries grow rapidly. A typical multi-server setup can easily have 50+ tools consuming 55,000+ tokens before any conversation starts. Worse, tool selection accuracy degrades when models face 30+ similarly-named tools. T...

This Week in Spring - October 14th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Boston and New York city and Bulgaria and Poland this week, but I'm still hyped about last week's amazing Devoxx Belgium event! There are a ton of videos to look at, and I'll include just some of them here. So, without...

HTTP Service Client Enhancements

In this 3rd blog post of the Road to GA series that’s highlighting major features within the Spring portfolio for the next major versions to be released in November we’ll have a look at new features for HTTP service clients, which are a collaborative effort across several Spring projects...

A Bootiful Podcast: Spring Cloud lead Spencer Gibb, live from SpringOne 2025

Hi, Spring fans! In this installment, we talk to the legendary lead of Spring Cloud and friend to the community, Spencer Gibb! This was recorded live from Las Vegas, NV, at the fantastic SpringOne 2025 event!...

This Week in Spring - August 5th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's August 5th! Which means we're only 20 days away until SpringOne 2025! Have you registered? There's so much to cover this week, so let's dive right into it! Spring Shell 3.4.1 is out! - the new release includes a number o...

A Bootiful Podcast: José Paumard, Java developer advocate and professor

Hi, Spring fans! In this installment, recorded at Devoxx UK 2025, I talk to the legendary professor of computer science and legend José Paumard about Java, the ecosystem, and more,...

A Bootiful Podcast: 'Mr. Apache' Jeff Genender

Hi, Spring fans! In this episode I'm joined by well-known member of the Java community Jeff Genender, whose contributions to Apache over the decades have driven several key projects with which you're no doubt familiar...

A Bootiful Podcast: Dez Blanchfield, a tech legend for all ages

Hi, Spring fans! Happy happy = new Year2025! It's a new year and a new opportunity! In this episode I talk to my friend and legendary technologist Dez Blanchfield!...

HTTP/3 support in Reactor 2024.0 Release Train

HTTP/3, the latest major version of the Hypertext Transfer Protocol, had its specification finalized in June 2022. This version is designed to enhance performance, reliability, and security. Unlike its predecessors, HTTP/3 utilizes QUIC instead of TCP as its transport layer. QUIC is a UDP-based,...

Authorization Bypass of Static Resources in WebFlux Applications

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true:...

Path traversal vulnerability in functional web frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

A Bootiful Podcast: Gradle and Develocity engineer and Spring community legend Eric Haag

Hi, Spring fans! In this episode I talk to Gradle and Develocity engineer and Spring community legend Eric Haag...

Spring Framework DoS via conditional HTTP request

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack...

A Bootiful Podcast: Tagir Valeev, Fellow Java Champion and IntelliJ IDEA Java legend

Hi, Spring fans! In today's installment we talk to Tagir Valeev, a fellow Java Champion and IntelliJ IDEA Java legend. Also: don't forget to try out the just-released Spring Boot 3.3 release!...

Spring Tips: Beans, Beans: What's in a Spring bean?

Hi, Spring fans! In this installment we explore the essential Spring bean. What are they, how are they created, and what do they mean to you?...

A Bootiful Podcast: Spring founders Rod Johnson and Juergen Hoeller on the 20th Anniversary of Spring Framework 1.0

Hi, Spring fans! In this episode, more than 20 incredible years in the making, Spring founders Rod Johnson @springrod and Juergen Hoeller @springjuergen discuss Spring since its 1.0 release in 2004...

Spring Tips: Hello, Java 22!

Hi, Spring fana! In this installment, I look at the amazing, just-released, Java 22!...

A Bootiful Podcast: Gunnar Morling on the 1BRC challenge and taking Java to BLAZING fast performance territory

Hi, Spring fans! In this installment, I talk to fellow Java Champion Gunnar Morling, and we look at how his 1BRC challenge helped the community eek out some of Java's best performance numbers...