Spring Framework 4.0.2 and 3.2.8 have been released and are now available from Maven Central and repo.spring.io.

We have brought forward both releases due to SPR-11376 which strengthens Spring OXM to protect against a XXE vulnerability.

For a complete list of changes please refer to JIRA