Spring Boot Vulnerabilities by Version: CVEs for Spring Boot 2.7, 3.x and 4.x

The short answer

Two Spring Boot lines have open source support. 4.1 is supported until 31 July 2027 and 4.0 until 31 December 2026; their latest releases are 4.1.1 and 4.0.8, both from 20 August 2026. Open source support for 3.5, the last 3.x line, ended on 30 June 2026 with 3.5.16, so every 3.x and 2.x release is now outside it. In 2026 spring.io has published 12 CVEs against Spring Boot itself. All 12 have public fixes on 4.0 and the ten that list 3.5 have public fixes there, but on 3.4, 3.3 and 2.7 every 2026 fix is marked Enterprise Support Only. The larger exposure is usually underneath Boot: the Spring Framework, Spring Security and Tomcat versions that each final release manages.

This guide covers Spring Boot's own CVEs and the dependency versions each Boot line pulls in. For the Framework CVEs in detail, see Spring Framework vulnerabilities by version.

Spring Boot release lines and their CVEs

Support dates are from spring.io, and the last public release is the newest version of each line on Maven Central. The CVE column lists Spring Boot advisories from 2023 onward whose affected ranges include the line.

"Do not list" means the advisory leaves the line out. The 2026 advisories give ranges for 3.3 and 2.7 but skip 3.0 to 3.2, which is not a finding that those lines are safe. For dates on every line, see the Spring Boot end of life tracker.

Spring Boot's own CVEs

CVSS is NVD's own score where NVD has scored the record, otherwise the score from VMware as the CNA. For several 2026 records the two disagree widely, because NVD scored the missing hostname checks as network attacks while VMware scored them as needing an adjacent network and high complexity. None of these CVEs is in CISA's Known Exploited Vulnerabilities catalogue.

Most of the list needs a specific setup, and each advisory spells it out. CVE-2026-40976 applies only to a servlet application with no Spring Security configuration of its own that depends on spring-boot-actuator-autoconfigure but not spring-boot-health. The two actuator bypasses need an application endpoint mapped under an actuator path, which the Spring team advises against. The hostname verification CVEs matter where a Boot application talks to Cassandra, RabbitMQ, Elasticsearch or a mail server over TLS on a network an attacker can reach. CVE-2026-40972 needs DevTools remote support, which should never run in production. The fifth 2023 CVE, CVE-2023-20883, is a denial of service through a reverse proxy cache, fixed in 3.0.7, 2.7.12, 2.6.15 and 2.5.15.

What each final release pulls in

A Spring Boot release fixes the versions of Spring Framework, Spring Security, Tomcat and hundreds of other libraries through spring-boot-dependencies. Leaving a Boot line usually means leaving those versions in place too. The versions below are from each release's POM on Maven Central.

CVE-2026-59313 and CVE-2026-47892 carry a 9.8 CVSS 3.1 score from CISA-ADP. Both affect Framework 5.3.0 to 5.3.49, 6.0.0 to 6.0.30, 6.1.0 to 6.1.28, 6.2.0 to 6.2.19 and 7.0.0 to 7.0.8, so 4.0.8 and 4.1.1, on Framework 7.0.9, are the only current Boot releases with the fix. CVE-2024-38821, a 9.1 authorization bypass for static resources in WebFlux applications, was fixed publicly in Security 6.2.7 and 6.3.4 and in commercial releases for 6.1, 6.0, 5.8 and 5.7. CVE-2025-24813 is in CISA's catalogue, added on 1 April 2025, but it needs writes enabled on Tomcat's default servlet, which is off by default.

Tomcat is the one dependency you can fix yourself on every line, because Apache still supports 9.0, 10.1 and 11.0. Setting the tomcat.version property to 9.0.122 on Boot 2.7, 10.1.60 on 3.x or 11.0.26 on 4.x takes the current Tomcat fixes without a new Boot release. Test it, since Boot was built against an older patch release. Framework and Security fixes cannot be taken that way on 2.7 to 3.5, because their open source releases stopped: the last public versions are 5.3.39, 6.0.23, 6.1.21 and 6.2.19 for Framework. Moving 2.7.18 from 5.3.31 to 5.3.39 still picks up the four public 2024 fixes. For the full Tomcat fix matrix, see Tomcat CVE fix releases for 9.0, 10.1 and 11.0.

What each line gets

Spring Boot 4.1 and 4.0

Both lines are supported, and 4.0.8 and 4.1.1 carry every Spring Boot fix above that applies to them. 4.0 has had all 12 of the 2026 CVEs, including CVE-2026-40976, which only affects 4.0, so an application on 4.0.0 to 4.0.5 should move to 4.0.8 now. Both releases manage Tomcat 11.0.24, two releases behind the Tomcat fix for CVE-2026-76183, which CISA-ADP scores 9.8. Open source support for 4.0 ends on 31 December 2026. See Spring Boot 4.0 end of life.

Spring Boot 3.5

3.5.16 has every Spring Boot fix that lists 3.5, because the last 2026 advisory came out in June, before support ended. The gap is underneath: Framework 6.2.19 is exposed to CVE-2026-59313, CVE-2026-47892 and CVE-2026-47884, and the 6.2.20 release that fixes them is not on Maven Central. Commercial support for 3.5 is listed until 30 June 2032. See Spring Boot 3.5 end of life.

Spring Boot 3.0 to 3.4

3.4.13 and 3.3.13 have no public fix for any 2026 Spring Boot CVE that names them, including both actuator bypasses at 8.1. 3.0 to 3.2 are not listed in the 2026 advisories at all. 3.2.12 and 3.1.12 have no public fix for CVE-2025-22235, and 3.1.12 and 3.0.13 have none for CVE-2024-38807. All five final releases manage Framework and Security versions that are now patched only commercially. Moving from 3.x to 4.x brings Framework 7 and Jackson 3; see the Spring Boot migration guide.

Spring Boot 2.7 and older

2.7.18, from November 2023, is the last public 2.7 release, and Boot 2 runs on Framework 5.3 and Java 8, which is why so many applications are still there. Seven 2026 CVEs list 2.7, and spring.io's fixes for them are in 2.7.32, 2.7.33 and 2.7.34, all Enterprise Support Only. Spring.io lists commercial support for 2.7 until 30 June 2029. 2.6 and older stopped at 2.6.15 and 2.5.15 in May 2023. See Spring Boot 2 end of life and Spring Framework 5 end of life.

What to do on each line

• 4.0 and 4.1. Stay on the latest patch release, set tomcat.version to 11.0.26 until the next Boot release manages it, and plan the move from 4.0 to 4.1 before 31 December 2026.
• 3.5. Set tomcat.version to 10.1.60. For Framework 6.2, check whether your application uses functional endpoints, Server-Sent Events or XsltView, which the 2026 Framework CVEs need, and plan the move to 4.x or take patched builds.
• 3.0 to 3.4. Upgrade to 3.5.16 as a stepping stone only if 4.x is close; otherwise move to 4.1 or take patched builds. Until then, keep application endpoints out of actuator paths, check that every EndpointRequest.to() target is enabled and exposed, and keep DevTools off production classpaths.
• 2.7 and older. Raise spring-framework.version to 5.3.39 and tomcat.version to 9.0.122 for the fixes that are still public, then plan the move to 3.x and 4.x or take patched builds. Enable hostname verification by hand where your version allows it, for example spring.mail.properties.mail.smtp.ssl.checkserveridentity=true.

For every Spring support date in one place, see the Spring support calendar.

Where OSSeva fits

OSSeva ships patched Spring Boot builds for 2.6.x, 2.7.x and 3.0.x to 3.5.x, and for 4.0.x after its open source end date. For Spring Boot 2.x the Spring Framework 5.3.x patches are included, and OSSeva backports fixes of this class to the end-of-life release lines it patches, delivered as signed artifacts through your own Maven or Gradle repository manager. They are available now on the Patch, Assure and Operate tiers. Assure adds a compliance attestation package and a Spring Boot 3 migration readiness assessment, and Operate adds 24/7 application monitoring with a 15-minute P1 response and a named senior Spring engineer. See Spring Boot extended support and Spring continuation.