This Week in Spring - September 10th, 2024

Hi, Spring fans! Or, I suppose: 안녕하세요, Spring 팬 여러분! I'm writing this from a café in scintillating Seoul, Korea. It's amazing. I've been talking to developers of all stripes who are using and building upon Spring to do all sorts of cool stuff. And tomorrow, it's off to jolly Japan. I'll be...

This Week in Spring - September 3rd, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's September 3rd, and I'm still buzzing from the last week's SpringOne extravaganza! Also: I'm tired. Last week was nuts. I'm super glad it happened, but I'm tired. And also buzzing. You know? Surely you don't. I hope not...

A Bootiful Podcast: Vaadin developer advocacy legend Marcus Hellberg

Hi, Spring fans! In this installment, I talk to Vaadin developer advocacy legend Marcus Hellberg about the lates-and-greatest in the wide and wonderful world of Spring...

Spring Expression DoS Vulnerability

In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language SpEL expression that may cause a denial of service DoS condition. Specifically, an application is vulnerable when the following is true:...

A Bootiful Podcast: Observability legend Jonatan Ivanov on the latest and greatest in Micrometer

Hi, Spring fans! In this installment we talk to observability legend Jonatan Ivanov about the latest and greatest in the wide and wonderful world of observability. Turns out a library that's used by countless projects including and beyond the Spring ecosystem keeps quite busy!...

A Bootiful Podcast: Digital Accessibility Architect, Java and Groovy legend, Scott Davis

Hi, Spring fans! In this episode I talk to Java ecosystem legend Scott Davis...

A Bootiful Podcast: Cloud Native Cora Iberkleid on architecture, Spring Modulith, and more

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In today’s episode, I talk to cloud native Cora Iberkleid about the awesome modular sensation that’s sweeping applications, Spring Modulith!...

A Bootiful Podcast: Oleg Šelajev, Docker and Testcontainers legend

Hi, Spring and Testcontainers fans! In this interview, I talk to Oleg Šelajev...

PKCE Downgrade in Spring Authorization Server

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An...

Spring Tips: the Spring Authorization Server: durability of data

Hi, Spring fans! In this installment, we continue our look at the venerable Spring Authorization Server, this time looking at how to configure persistence and durability for various aspects of the system...

Reactor Netty HTTP Server Metrics DoS Vulnerability

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in...

Directory Traversal in Reactor Netty HTTP Server

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured t...

A Bootiful Podcast: VMware vice president Betty Junod

Hi, Spring fans! In this installment Josh Long talks to VMware vice president Betty Junod about VMware, its amazing ecosystem, and so much more...

This Week in Spring - May 9th, 2023

Hi, Spring fans! Welcome to another wonderful, fancyful installment of This Week in Spring! I was just at the first Devoxx GR, in the sunny mediterranean city of Athens, Greece. Uh, yah, this was a good'un. If you can get to it, you should. Don't miss next year's installment if you missed this on...

A Bootiful Podcast: Spring Cloud Stream and Spring Cloud Function lead Oleg Zhurakousky

Hi Spring fans! Welcome to another installment of a bootiful podcast! in this installment, our pal Oleg Zhurakousky @zoleg, lead of Spring Cloud Stream and Spring Cloud Function, rejoins the show to talk about the latest and greatest in stream processing...

A Bootiful Podcast: GraalVM advocate Alina Yurenko on a Bootiful Podcast

Liiiive from New York, it's a Bootiful Podcast! This week I @starbuxman talk to Developer Advocate for GraalVM at Oracle Labs, and legend, Alina Yurenko @alinayurenko...

Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can...

Spring Social CSRF

When authorizing an application against an OAuth 2 API provider, Spring Social is vulnerable to a Cross-Site Request Forgery CSRF attack. The attack involves a malicious user beginning an OAuth 2 authorization flow using a fake account with an OAuth 2 API provider, but completing it by tricking t...

XML External Entity (XXE) injection in Spring Framework

It was identified that Spring MVC processed user provided XML with JAXB in combination with a StAX XMLInputFactory without disabling external entity resolution. External entity resolution has been disabled in this case. It was subsequently discovered that this fix was incomplete CVE-2013-6429,...

A Bootiful Podcast: Joe Grandja on Spring Authorization Server, OAuth, and so much more

Hi, Spring fans! In this episode, I talk Spring Security’s Joe Grandja about Spring Authorization Server’s graduation into Spring Security 7, and the new security heavyweights DPoP and PAR...

CVE-2026-59287

CVE-2026-59287...

CVE-2026-59294

CVE-2026-59294...

A Bootiful Podcast: JRuby lead Charles Nutter

In this episode, we sit down with the lead of the JRuby project for a fascinating look at how Ruby and the JVM came together, how JRuby became a production-ready powerhouse, and why it still matters today. We dig into threading, performance, Invoke Dynamic, Project Loom, Panama, Valhalla, and the...

cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests

cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests...

cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests

cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests...

cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions...

cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses...

cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC

cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC...

cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names...

cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder...

A Bootiful Podcast: Sébastien Deleuze on the latest-and-greatest in Spring AI and Spring Framework

Hi Spring fans! In this installment we talk to the legendary Spring AI and Spring Framework contributor Sébastien Deleuze about the latest-and-greatest in AI, Kotlin, the framework, and more...

cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service

cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service...

A Bootiful Podcast: Mark Kropf on AI orchestration

Hi Spring fans! I was delighted to get a chance to sit and talk to my pal and Pivotal alum Mark Kropf about his efforts around orchestrating AI. This doesn’t have to do with the JVM or Spring, per se, but it’s an interesting discussion nonetheless...

This Week in Spring - January 6th, 2026

Hi, Spring fans, to the first installment of This Week in Spring in the new year and , roughly, the fifteenth anniversary edition of this series! I've been writing these blogs since the first week of January of 2011, and I am proud to say that I haven't so far missed a single week! I've always...

This Week in Spring - November 18th, 2025

This Week in Spring - November 18th, 2025 Hi, Spring fans! I'm thrilled to be in New York City for an exciting week of joint presentations on Spring AI + Bedrock and Spring Boot with the legendary James Ward. First up: we'll present a workshop at the AI Native Dev Conf today, then speak at the...

A Bootiful Podcast: The legendary Bruce Eckel on language design, effects, abstraction, concurrency, and so much more

Hi, Spring fans! In this installment, I sit down with the legendary Bruce Eckel, who has probably forgotten more about programming languages than I will ever know, and whose book Thinking in Java helped launch me into a career...

This Week in Spring - October 21st, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm writing this from the fantastic Vaadin Create conference here in Frankfurt, Germany. What an amazing show and community. Since we last spoke, I have been in Boston; New York city; Sofia, Bulgaria; Krakow, Poland; and now...

A Bootiful Podcast: Johannes Bechberger, Java engineer at SAP

Hi, Spring fans! In this installment I talk to Johannes Bechberger, Java engineer working on profilers and their underlying technology in the SapMachine team at SAP. His work today comprises many open-source contributions and his blog, where he regularly writes on in-depth profiling and debugging...

Building Effective Agents with Spring AI (Part 1)

In a recent research publication: Building effective agents, Anthropic shared valuable insights about building effective Large Language Model LLM agents. What makes this research particularly interesting is its emphasis on simplicity and composability over complex frameworks. Let's explore how...

Spring LDAP Spring LDAP sensitive data exposure for case-sensitive comparisons

The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820...

A Bootiful Podcast: Tanzu's Cloud and Spring legend Chris Sterling

Hi, Spring fans! In this installment I talk to the Tanzu legend Chris Sterling, who works on making Spring an even more valuable part of a platform. This episode was recorded live at the epic SpringOne 2024 event!...

A Bootiful Podcast: Roni Dover on Digma AI

Hi, Spring fans! In this installment we talk to Digma AI founder Roni Dover...

Spring Framework URL Parsing with Host Validation

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks...

This Week in Spring - April 5th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Im back home from the Hawaiin islands. Its so good to be home. First things first: theres a security vulnerability. Weve already released guidance on how to mitigate as well as new releases of Spring Framework and Spring Boot...

A Bootiful Podcast: Kubernetes cofounder and vice president of R&D at VMware, Craig McLuckie

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In this episode, Josh Long @starbuxman talks to Kubernetes cofounder, all-around nice person, and vice president of R&D at VMware, Craig McLuckie @cmcluck...

Spring Cloud Gateway HTTP2 Insecure TrustManager

Applications using Spring Cloud Gateway that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...

Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data , the path elements following...

Potential Security Bypass for customized Spring Data REST Resource

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

RFD Protection Bypass via jsessionid

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...

Jackson Configuration Allows Code Execution with Unknown “Serialization Gadgets”

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means...