Spring Framework CVE-2024-38828 published

Releases | Brian Clozel | November 15, 2024 | ...

The Spring Framework has released version 5.3.42 that contains a fix for:

  • CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter

Note that open source support for Spring Framework 5.3.x and 6.0.x generations has ended last August, as announced previously. This fix has only been applied to the 5.3.42 commercial release, available now.

If you are not a commercial customer, please consider upgrading to an open source supported version at your earliest convenience.

Upgrading Your Project

Commercial customers using Spring Boot 2.7 can make use of Spring Boot Hotfix release 2.7.22.4. Releases are available now on the Spring commercial artifact repository and can be accessed with a Spring Enterprise Subscription

Spring Framework 6.2.0 Available Now

Releases | Brian Clozel | November 14, 2024 | ...

On behalf of the team and everyone who has contributed, I am pleased to announce that Spring Framework 6.2.0 is available now. We would like to thank our community of "early adopters" who helped us refine this version during the milestone phase.

This new Spring generation will materialize in Spring Boot applications next week with Spring Boot 3.4.0. We wrote extensive release notes that will let you know how to easily upgrade and leverage the new features.

The Framework team is already working on the next major release as announced previously. Keep an eye on our official support timeline to…

This Week in Spring - November 12th, 2024

Engineering | Josh Long | November 12, 2024 | ...

Hi, Spring fans! Welcome to another installment of This Week in Spring!

Spring Cloud 2024.0.0-RC1 (aka Moorgate) Has Been Released

Releases | Olga Maciaszek-Sharma | November 08, 2024 | ...

On behalf of the community, I am pleased to announce that the Release Candidate 1 (RC1) of the Spring Cloud 2024.0.0 Release Train is available today. The release can be found in Spring Milestone repository. You can check out the 2024.0.0-RC1 release notes for more information.

Notable Changes in the 2024.0.0-RC1 Release Train

This release of Spring Cloud is based on Spring Boot 3.4.0-RC1.

The GitHub project for this release can be found here.

Spring Cloud Gateway

  • Implement ModifyResponseBody in MVC Server (#3189
  • Use new Spring Boot http client autoconfiguration framework (#3571

Spring Cloud…

This Week in Spring - November 5th, 2024

Engineering | Josh Long | November 05, 2024 | ...

This Week in Spring - November 5th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's the 5th of November, 2024, and, um, I - an American - am desperately trying to keep calm and carry on. I did everything I can do (VOTE!), and so it's with considerable enthusiasm that I dive into this week's (hopefully distracting) roundup!

This Week in Spring - October 29th, 2024

Engineering | Josh Long | October 29, 2024 | ...

Hi, Spring fans! How're things? It's almost Halloween! I'm so excited! I'm going as a PHP program. Boooooooo...t. I'm writing this from the amazing Vaadin Create conference in Frankfurt, Germany, about to do my keynote for an amazing, Spring-loving audience here. So, without further ado, let's dive right into it!

Spring Modulith 1.3 RC1, 1.2.5, and 1.1.10 released

Releases | Oliver Drotbohm | October 28, 2024 | ...

On behalf of the community, I am delighted to announce the avability of Spring Modulith 1.3 RC1, 1.2.5, and 1.1.10. While the service releases contain a few bugfixes and the usual dependency updates, the release candidate is packed with features and improvements such as (full change log here):

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all