Spring Boot 2.7 end of life
Spring Boot 2.7 ended open-source support on 30 June 2023 and was the final 2.x line. Broadcom sells commercial support for it to 30 June 2029, and that subscription is the only upstream source of fixes. The last open-source release was 2.7.18. Any Spring Boot 2.x application not covered by a commercial agreement has received no upstream security patches since.
What now
Which vendors provide Spring Boot 2.7 security patches now that support has ended?
Spring Boot Extended Support for 2.x and Spring Framework 5- End of life
- 30 June 2023 (OSS support)
- Released
- May 2022
- Final release
- 2.7.18
- Successor
- Spring Boot 3.5 or 4.0
Date published by Spring Boot support policy. We do not publish a lifecycle date we cannot source. Dates checked against endoflife.date and spring.io on 20 October 2026.
Last reviewed
Spring Boot versions: release and end-of-life dates
| Version | Released | End of life | Status |
|---|---|---|---|
| Spring Boot 4.0 | 20 Nov 2025 | 31 December 2026 | Approaching |
| Spring Boot 3.5 | 22 May 2025 | 30 June 2026 | End of life |
| Spring Boot 3.4 | 21 Nov 2024 | 31 December 2025 | End of life |
| Spring Boot 2.7 (this page) | 31 May 2022 | 30 June 2023 (OSS support) | End of life |
End-of-life dates are published by each project and checked against endoflife.date.
What actually stops on 30 June 2023
- Open-source patch releases on the 2.7 line. 2.7.18 was the last.
- Dependency version management for the 2.7 BOM, which is the part that bites: Spring Boot's value is the curated dependency set, and it stops being curated. Transitive CVEs in Jackson, Tomcat, Logback and Netty stop being resolved for you.
- Compatibility updates for newer Java versions. Spring Boot 2.7 supports Java 8 through 17 and will not be updated for later JDKs.
What actually breaks in the upgrade
2 to 3 is javax to jakarta, plus a Java 17 floor
Spring Boot 3 requires Java 17 as a minimum and moves to Jakarta EE, so every javax.* import in servlet, persistence and validation code becomes jakarta.*. Two breaking changes arrive together, which is why this migration stalls: teams on Java 8 have to do the JDK upgrade and the namespace migration in the same programme.
The dependency BOM is the hidden scope
Upgrading Spring Boot moves dozens of managed dependency versions at once. The Spring code change is usually small; the regression surface is every library the BOM bumps. Budget testing accordingly, and read the dependency version diff before you start, not after.
Spring Security is a separate, larger migration
Spring Security 5 to 6 removed WebSecurityConfigurerAdapter and moved wholesale to the lambda DSL. For applications with non-trivial security configuration this is frequently the single longest task in a Boot 2 to 3 upgrade, and it is worth scoping separately.
What the buyers actually say
In our own conversations, the most common position is not 'help us upgrade'. It is 'we need to check the compliance box on the version we are on'. Broadcom's commercial terms are set per core with a minimum commitment, which can put that box out of reach for a mid-size estate, and that is the gap extended support fills.
CVEs since Spring Boot 2.7 open-source support ended
Open-source support for 2.7 ended on 30 June 2023. Every fix since then ships only as a commercial 2.7 release, so a team without a Broadcom subscription cannot get it from Spring. These are the 2.7 advisories in OSSeva's CVE directory.
Counts from the directory as of 20 October 2026 (Spring Boot 2.7: 6 since 30 Jun 2023, 5 scored 7.0 or higher).
| Line | CVE | CVSS | Published | Issue | Fixed in (commercial builds only) |
|---|---|---|---|---|---|
| Spring Boot 2.7 | CVE-2026-40974 | 9.8 | 28 Apr 2026 | Spring Boot: Cassandra auto-configuration does not verify the server hostname over SSL | 2.7.33 |
| Spring Boot 2.7 | CVE-2026-40972 | 7.5 | 28 Apr 2026 | Spring Boot DevTools: timing attack on the remote secret | 2.7.33 |
| Spring Boot 2.7 | CVE-2026-40975 | 7.5 | 28 Apr 2026 | Spring Boot: ${random.value} values are not suitable for use as secrets | 2.7.33 |
| Spring Boot 2.7 | CVE-2026-22733 | 8.1 | 20 Mar 2026 | Spring Boot Actuator: authentication bypass for endpoints under the Cloud Foundry actuator path | 2.7.32 |
| Spring Boot 2.7 | CVE-2025-22235 | 7.3 | 28 Apr 2025 | Spring Boot: EndpointRequest.to() creates a matcher for null/** when the endpoint is not exposed | 2.7.25 |
| Spring Boot 2.7 | CVE-2024-38807 | 6.3 | 23 Aug 2024 | Spring Boot Loader: signature forgery in nested jar verification | 2.7.22 |
The directory lists Spring Boot CVEs matched at NVD to the product, mostly with a CVSS score of 7.0 or higher, so it is a subset of every Spring Boot advisory. Fixed-in versions are from the Spring advisories; versions above 2.7.18 are commercial releases.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Spring Boot 3.5 | Java 17 floor plus the Jakarta namespace migration plus Spring Security 6. | Scales with code volume and test coverage | Engineering time | The right destination. Scope Spring Security separately; it is usually the long pole. |
| Commercial Spring subscription | Broadcom's paid Spring support, which covers Spring Boot 2.7 until 30 June 2029, now part of the TrueSource and Spring Enterprise packaging. | Procurement | Core-based minimums apply | Straightforward if the estate is large enough to absorb the minimum. Frequently not, for mid-size estates. |
| Extended support on Spring Boot 2.7 | Backported CVE fixes for the Boot 2.7 line and the managed dependencies around it. | Days to onboard | Subscription per application or estate | The answer when the migration is real but will take quarters and the audit will not wait. |
| Stay unpatched | No upstream patches since mid-2023, plus an unmanaged dependency set. | None | Zero now | The transitive dependency exposure alone makes this hard to defend in any scanned environment. |
What OSSeva does for Spring Boot 2.7
OSSeva patches this line
OSSeva backports CVE fixes to Spring Boot 2.7 and to the dependency set the 2.7 BOM manages, delivered as signed Maven artifacts through your own repository manager. We are specific about scope before you buy: Spring is a very large surface, and we will tell you exactly which projects and which transitive dependencies are inside the agreement rather than selling 'Spring support' and negotiating later.
Spring Boot extended supportWhat your auditor will say
Requirement 6.3.3, applied to the application framework and every dependency it pulls. Unmanaged transitive CVEs are what scanners surface first.
CC7.1. The dependency set is the evidence problem: a Boot 2.7 application's SBOM shows dozens of components with no upstream fix path.
For EU financial entities, ICT third-party risk provisions engage when a critical application depends on software with no support arrangement in place.
When did Spring Boot 2 reach end of life?
Open-source support for Spring Boot 2.7, the final 2.x line, ended on 30 June 2023. The last open-source release was 2.7.18. Commercial support from Broadcom continued beyond that under a paid subscription.
Is Spring Boot 2.7 still supported?
Not in open source. It receives no community patches. Commercial Spring support and third-party extended support are the remaining options.
What is required to upgrade from Spring Boot 2 to 3?
Java 17 as a minimum, and the Jakarta EE namespace migration from javax.* to jakarta.* across servlet, persistence and validation code. If you also use Spring Security, the 5 to 6 migration removes WebSecurityConfigurerAdapter and is usually the largest single task.
Can I get security patches for Spring Boot 2.7?
Yes. Broadcom offers commercial Spring support, and third-party providers including OSSeva, HeroDevs and TuxCare backport CVE fixes to the 2.7 line. OSSeva also covers the managed dependency set, which is where most findings actually appear.
Why do Spring Boot 2 applications show so many CVEs?
Because Spring Boot's core value is a curated dependency set, and that curation stopped. The CVEs are mostly transitive — Jackson, Netty, Logback, embedded Tomcat — rather than in Spring itself, and nobody is bumping them for you.
How much does commercial Spring support cost?
Broadcom sells commercial Spring support through Tanzu Spring subscriptions and does not publish the prices. Third-party extended support exists for teams that need patched builds without that subscription. OSSeva prices Spring support per application; book a discovery call for a quote.
Get a quote
Still running Spring Boot 2.7?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?