1067 matches found
This Week in Spring - May 19th, 2026
Hi Spring fans! Welcome to another installment of This Week in Spring!, this one written from the back of a taxi racing to the local Frankfurt train station, where I'll take a train to Munich for the amazing Kotlin Conf 2026 edition, where I'll be part of the keynote and deliver a talk on the...
This Week in Spring - April 21st, 2026
Hi Spring fans! Welcome to another installment of This Week in Spring! What a week it's been since we last talked. I was in Barcelona, Spain, for the amazing Spring I/O event there. It has become my favorite show, full stop. Just such an amazing experience. So many wonderful things going on there...
This Week in Spring - October 28th, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's a wonderful tuesday here in my home town of San Francisco as I write this from my condo's balcony, fresh off more than three weeks on the road. By the time we'll speak again in a week, Halloween will have come and gone...
Introducing Jackson 3 support in Spring
This is a new blog post in the Road to GA series, this time sharing more details on the new Jackson 3 support, just a few days after Jackson 3.0.0 GA release, about to be introduced in Spring Boot 4 and related Spring portfolio projects. Jackson is by far the most used JSON library on the JVM, an...
The state of HTTP clients in Spring
This is a new blog post in the Road to GA series, this time exploring the new capabilities of our HTTP clients. This is also a good time to reflect on the state of HTTP clients in Spring, so we will use this opportunity to explain an important announcement: we are officially deprecating...
API Versioning in Spring
In this 2nd blog post of the Road to GA series highlighting major features within the Spring portfolio for the next major versions to be released in November, I’m going to focus on the upcoming API Versioning support in Spring Framework 7. Introduction API versioning is a challenging topic. Most...
This Week in Spring - August 19th, 2025
Hi, Spring fans! Welcome to another extra special installment of This Week in Spring - special because the next installment will be delivered from the floors of the Ventian where the extraordinairily awesome SpringOne 2025 event will take place! So, some poetry: T’was the Week Before SpringOne...
A Bootiful Podcast: Spring legends Tasha Isenberg and Jason Konicki
Hi, Spring fans! In this edition, I had the pleasure of chatting with the brilliant Arjen Poutsma, our go-to API oracle. If you’re curious about his fantastic insights, thoughts, and consultancy services, be sure to check out poutsma-principles.com...
A Bootiful Podcast: Spring IO founder Sergi Almar on Spring IO 2025
Hi, Spring and Spring I/O fans! In this installment we have the privilege of chatting with friend of the community and legend Sergi Almar about the amazing Spring IO 2025, where this episode was published, and a lot more...
Spring Cloud Config Server May Not Use Vault Token Sent By Clients
Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: In this case the SessionManager persists the first token it retrieves and will continue to use that...
A Bootiful Podcast: Apache Causeway’s Dan Haywood
Hi, Spring fans! In this installment I talk to the legendary Dan Haywood, contributor to the Apache Causeway project...
A Bootiful Podcast: the amazing K. Siva Prasad Reddy (SivaLabs)
Hi, Spring fans! In today's installment I talk to industry legend K. Siva Prasad Reddy @sivalabs. You've probably read one of his blogs. I know I have!...
This Week in Spring - December 10th, 2024
Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this I am in the southern hemisphere it's summer down here!, in Brisbane, waiting to board a plane for Sydney. It's been a ton of fun! I did a video looking at the latest-and-greatest in Spring Framework 6.2 - chec...
Path traversal vulnerability in functional web frameworks
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...
Signature Forgery Vulnerability in Spring Boot's Loader
Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another...
A Bootiful Podcast: Jetbrains Developer Advocate Pasha Finkelshteyn
Hi, Spring fans! In this week's installment I talk to Jetbrains' Developer Advocate Pasha Finkelshteyn...
Spring Tips: GRPC
Hi, Spring fans! In this installment, we look at how to create GRPC-based services with Spring Boot...
A Bootiful Podcast: Microcks.io contributors Laurent Broudoux and Yacine-Kheddache
Hi, Spring fans! In this installment, I talk about the wide world of AI and then discuss microservice testing with Microcks.io contributors and founders Laurent Broudoux and Yacine-Kheddache. This was recorded live from Devoxx BE 2023!...
A Bootiful Podcast: iText Creator Bruno Lowagie
Hi, Spring fans! We're releasing Spring Boot 3.2 today! And it's Thanksgiving in the USA Happy Thanksgiving!. So, we wanted to celebrate with an amazing episode, and so today's guest is opensource legend Bruno Lowagie. Enjoy!...
A Bootiful Podcast: Spring Security lead Rob Winch
Hi, Spring fans! Welcome to another installment of a Bootiful Podcast. In this interview, Josh Long @starbuxman talks to Spring Security legend and lead Rob Winch @robwinch, recorded live from SpringOne 2023!...
A Bootiful Podcast: Spring team legend Dr. David Syer on view rendering technologies, the latest-and-greatest, SpringOne 2023, and more
Hi, Spring fans! In this installment Josh Long talks to the legendary Dr. David Syer about view rendering technologies, SpringOne, and more. Have you registered for SpringOne yet? Are you interested in learning Spring? Check out Spring Academy...
A Bootiful Podcast: Angular Google Developer Expert Santosh Yadav
Hi, Spring fans! In this installment Josh Long @coffesoftware talks to Angular Google Developer Expert Santosh Yadav @santoshyadavdev about the latest and greatest in the JavaScript and Angular ecosystem...
A Bootiful Podcast: Spring Boot team member Moritz Halbritter (@m_halbritter)
Hi, Spring fans! In this installment Josh Long YouTube.com/@coffeesoftware.com talks to Spring Boot team member Moritz Halbritter @mhalbritter...
A Bootiful Podcast: James Ward, Kotlin Product Manager at Google
Hi, Spring fans! In this installment Josh Long talks to James Ward, Kotlin Product Manager at Google...
This Week in Spring - March 7th, 2023
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's an amazing week, and this week we've got a lot to look at. Let's dive right into it. Spring Cloud Function for Azure Function Spring Data 2022.0.3 and 2021.2.9 released Spring R2DBC for Reactive Relational Databases in...
A Bootiful Podcast: RabbitMQ engineer Arnaud Cogoluègnes on the new and novel in RabbitMQ
Hi, Spring fans! In this episode, Josh Long @starbuxman talks to RabbitMQ engineer Arnaud Cogoluègnes @acogoluegnes on the new and novel in RabbitMQ...
A Bootiful Podcast: Google mad scientist Josh Suereth on Observability with OpenTelemetry, building better build tools, and so much more
Hi, Spring fans! In this installment, Josh Long @starbuxman looks at the latest and greatest in Spring Boot 3 AOT, then talks to Googles Josh Suereth @jsuereth about observability with OpenTelemetry, building better build tools, and so much more. Want to learn more about Spring Boot and the wider...
Delete Passwords: Passwordless Connections for Spring Boot Apps to Azure Services
Using username/password credentials to access one application from another presents a huge security risk for many reasons. Today, we are announcing the preview of passwordless connections for Java applications to Azure database and eventing services, letting you finally shift away from using...
A Bootiful Podcast: Hashicorp's Rosemary Wang on securing the intersection of apps and ops with Hashicorp Vault
Hi, Spring fans! In this episode Josh Long @starbuxman talks to Hashicorp Developer Advocate Rosemary Wang @joatmon08 about a few Hashicorp technologies and their integrations with Spring Boot...
A Bootiful Podcast: JVM and .NET legend Ted Neward on... just about everything
Hi, Spring fans! In this installment, I @starbuxman talk to my old friend, world-famous polyglot and code curmudgeon, software philosopher, industry veteran, and legend of ecosystems aplenty, Ted Neward @tedneward...
This Week in Spring - May 10th, 2022
Hi, Spring fans! Im writing this from - I cant believe I get to say this - abroad! Im in London, UK! Now, this is not particularly noteworthy for those millions who already live here. But I dont live here. Im a visitor! I live in San Francisco. I had to fly here! On a plane! With other people!...
Spring Framework RCE via Data Binding on JDK 9+
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...
RFD Protection Bypass via jsessionid
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...
Reactor Netty Consumes a Vulnerable Version of Netty
Reactor Netty, versions 0.8.x prior to 0.8.13 and 0.9.x prior to 0.9.1, depends on vulnerable versions of netty versions prior to 4.1.42, which incorrectly handles whitespace before a colon in headers, leading to HTTP request smuggling attacks...
Additional information exposure with Spring Data JPA derived queries
This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE...
Open Redirector in spring-security-oauth2
Spring Security OAuth, versions 2.3 prior to 2.3.5 , and 2.2 prior to 2.2.4 , and 2.1 prior to 2.1.4 , and 2.0 prior to 2.0.17 , and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request t...
Spring Data JPA Blind SQL Injection Vulnerability
Sort instances handed into user defined Spring Data repository query methods using manually declared JPQL queries are handed to the persistence provider as is and allow attackers to inject arbitrary JPQL into ORDER BY clauses which they might use to draw conclusions about non-exposed fields based...
RFD Attack in Spring Framework
Under some situations, the Spring Framework is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the...
XML eXternal Entity (XXE) injection in Spring Framework
The Spring OXM wrapper did not expose any property for disabling entity resolution when using the JAXB unmarshaller. There are four possible source implementations passed to the unmarshaller: DOMSource, StAXSource, SAXSource and StreamSource. For a DOMSource, the XML has already been parsed by us...
Spring Office Hours Podcast: S5E25 - Future of Software Development with Josh Long
Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by the legendary Josh Long. In this episode, we will look into the future of software development. We will also address at least one hot take that recently made the round...
This Week in Spring - September 29th, 2026
Hi, Spring fans! Welcome to another rip-roarin' and exciting installment of This Week in Spring! We've got a ton of cool stuff to look at this week, so let's dive right into it! an important update on Spring's release practice Speaking of which, we had a slew of releases on the 24th, including...
A Bootiful Podcast: Joe Grandja on Spring Authorization Server, OAuth, and so much more
Hi, Spring fans! In this episode, I talk Spring Security’s Joe Grandja about Spring Authorization Server’s graduation into Spring Security 7, and the new security heavyweights DPoP and PAR...
A Bootiful Podcast: JRuby lead Charles Nutter
In this episode, we sit down with the lead of the JRuby project for a fascinating look at how Ruby and the JVM came together, how JRuby became a production-ready powerhouse, and why it still matters today. We dig into threading, performance, Invoke Dynamic, Project Loom, Panama, Valhalla, and the...
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests...
cve-2026-59311 - MEDIUM - Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
cve-2026-59311 - MEDIUM - Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation...
cve-2026-41003 - HIGH - Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
cve-2026-41003 - HIGH - Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting...
Spring Office Hours Podcast: S5E12 - Developer Soft Skills with Arun Gupta
Join Dan Vega and DaShaun Carter for another essential update from the Spring ecosystem. In this episode, the guys are joined by DevRel and Java legend Arun Gupta to discuss a topic often overlooked but vital for career longevity: soft skills for developers. Drawing from his decades of experience...
This Week in Spring - January 6th, 2026
Hi, Spring fans, to the first installment of This Week in Spring in the new year and , roughly, the fifteenth anniversary edition of this series! I've been writing these blogs since the first week of January of 2011, and I am proud to say that I haven't so far missed a single week! I've always...