Spring Boot 3.4 end of life
Spring Boot 3.4 reached the end of open source support on 31 December 2025, and spring.io lists commercial support ending on 31 December 2026. 3.4.0 was released on 21 November 2024 and the last open source release is 3.4.13, from 18 December 2025. After 2026, spring.io lists no support of any kind for 3.4. OSSeva ships patched 3.4 artifacts.
- End of life
- 31 December 2025
- Released
- Nov 2024
- Final release
- 3.4.13 (last open source release, 18 December 2025)
- Successor
- Spring Boot 4.1, by way of the latest 3.5.x
Date published by spring.io Spring Boot generations. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 31 December 2025
- Open source 3.4.x releases. 3.4.13 is the last on Maven Central; later 3.4 releases, up to 3.4.18, are commercial only.
- Open source fixes for the lines 3.4 manages. 3.4.13 manages Spring Framework 6.2.15 and Spring Security 6.4.13. Security 6.4 left open source support on the same day as Boot 3.4, and Framework 6.2 followed on 30 June 2026. CVE-2026-59313 affects Framework 6.2.0 to 6.2.19, and spring.io lists its 6.2 fix as Enterprise Support Only.
- Commercial support, on 31 December 2026. From then on, 3.4 has no vendor support at all.
What actually breaks in the upgrade
3.5 is not a resting place
Spring Boot 3.5 left open source support on 30 June 2026, so moving 3.4 to 3.5 restores no open source fixes. Its value is as a step: the Boot 4 migration guide asks you to upgrade to the latest 3.5.x before starting.
Boot 4 is a generation change
Spring Boot 4 needs Java 17 or later, is based on Jakarta EE 11 with a Servlet 6.1 baseline, and requires Spring Framework 7. Classes, methods and properties deprecated in 3.x are removed. Plan it as a major upgrade with a full regression cycle.
Aim at 4.1 or 4.2
Boot 4.0 open source support ends on 31 December 2026. 4.1 runs to 31 July 2027, and spring.io lists 4.2 with a first release on 30 November 2026 and open source support to 31 December 2027.
Patch the embedded container meanwhile
Apache still supports Tomcat 10.1, so a 3.4 application can set tomcat.version to the latest 10.1 release, 10.1.60 at the time of writing, in place of the 10.1.50 that 3.4.13 manages.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Spring Boot 4.1 | Through the latest 3.5.x, then to Framework 7 and Jakarta EE 11. | Weeks to months | Engineering time | The supported path, open source to 31 July 2027. |
| Broadcom commercial support | Commercial 3.4 releases until 31 December 2026. | Procurement | Commercial subscription | Ends on 31 December 2026, with nothing after it. |
| OSSeva patched Spring Boot 3.4 | Signed 3.4 artifacts with backported fixes for Boot, Framework 6.2 and Security 6.4. | Days | Subscription | For applications that need time for the Boot 4 move. |
| Stay on 3.4.13 | No open source fixes since December 2025. | None | Zero now | CVE-2026-59313 already applies to the Framework 6.2.15 it manages. |
What OSSeva does for Spring Boot 3.4
OSSeva patches this line
OSSeva ships patched, signed Spring Boot 3.4 artifacts with backported fixes for Spring Boot and for the Spring Framework 6.2 and Spring Security 6.4 lines it manages, delivered through your own Maven or Gradle repository manager. They are available on the Patch, Assure and Operate tiers.
Spring Boot extended supportWhat your auditor will say
Every system component in the cardholder data environment needs its applicable security patches. A component with no upstream fix supply needs a patched source or a documented compensating control.
Auditors ask for evidence that production systems receive security fixes. A version past end of life fails that test unless another supplier ships the fixes and can show which CVEs they close.
Spring Boot 3.4: common questions
When did Spring Boot 3.4 reach end of life?
Open source support ended on 31 December 2025. spring.io lists commercial support until 31 December 2026.
Is Spring Boot 3.4 still supported?
Only commercially, and only until 31 December 2026. No open source 3.4 release has shipped since 3.4.13 in December 2025.
What is the last open source Spring Boot 3.4 release?
3.4.13, released on 18 December 2025. It manages Spring Framework 6.2.15, Spring Security 6.4.13 and Tomcat 10.1.50.
What should I upgrade Spring Boot 3.4 to?
Spring Boot 4.1, going through the latest 3.5.x first as the Boot 4 migration guide recommends. 3.5 itself is out of open source support.
Can I get security patches for Spring Boot 3.4?
Yes. OSSeva ships patched, signed Spring Boot 3.4 artifacts on the Patch, Assure and Operate tiers.
Still running Spring Boot 3.4?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.