Spring Boot 3.5 end of life
Spring Boot 3.5 reached the end of open source support on 30 June 2026, and spring.io lists commercial support until 30 June 2032. 3.5.0 shipped on 22 May 2025 and the last open source release is 3.5.16, from 25 June 2026. It was the final 3.x line, so every Spring Boot 3 release now gets fixes only through commercial support. OSSeva ships patched 3.5 artifacts.
- End of life
- 30 June 2026
- Released
- May 2025
- Final release
- 3.5.16 (last open source release, 25 June 2026)
- Successor
- Spring Boot 4.1
Date published by spring.io Spring Boot generations. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 30 June 2026
- Open source 3.5.x releases. 3.5.16 is the last on Maven Central.
- Open source fixes for the Spring Framework 6.2 and Spring Security 6.5 lines that 3.5 manages, which ended on the same day. CVE-2026-59313 and CVE-2026-47892, which NVD rates 9.8, affect Framework 6.2.0 to 6.2.19, and spring.io lists the 6.2.20 fix as Enterprise Support Only.
- Managed dependency updates. 3.5.16 manages Tomcat 10.1.55, and CVE-2026-76183, a WebSocket security constraint bypass that NVD rates 9.8, is fixed in Tomcat 10.1.60.
What actually breaks in the upgrade
Override what you can today
Tomcat 10.1 is still supported by Apache, so a 3.5 application can set tomcat.version to 10.1.60 or later without a new Boot release. Framework and Security cannot be fixed that way, because their 6.2 and 6.5 fixes are not published as open source.
Boot 4 is a generation change
Spring Boot 4.1.0 manages Spring Framework 7.0, Spring Security 7.1, Jakarta Servlet 6.1, Hibernate 7.4 and Jackson 3. Boot 3.5.16 manages Framework 6.2, Security 6.5, Servlet 6.0 and Hibernate 6.6. Plan it as a major upgrade with a full regression cycle, not a version bump.
Aim at 4.1, not 4.0
Spring Boot 4.0 open source support ends on 31 December 2026. 4.1 is supported to 31 July 2027, and spring.io lists 4.2 with a first release on 30 November 2026. Moving to 4.0 now buys three months.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Spring Boot 4.1 | Framework 7, Security 7.1, Jakarta EE 11 APIs and Jackson 3. | Weeks to months | Engineering time | The supported path, open source to 31 July 2027. |
| OSSeva patched Spring Boot 3.5 | Signed 3.5 artifacts with backported fixes for Boot, Framework 6.2 and Security 6.5. | Days | Subscription | For applications that need time for the Boot 4 move. |
| Broadcom commercial support | Commercial 3.5 releases, listed to 30 June 2032. | Procurement | Commercial subscription | A long vendor date, on Broadcom's terms. |
| Stay on 3.5.16 | No open source fixes since June 2026. | None | Zero now | Scanners already flag the August 2026 Framework CVEs against it. |
What OSSeva does for Spring Boot 3.5
OSSeva patches this line
OSSeva ships patched, signed Spring Boot 3.5 artifacts with backported fixes for Spring Boot and the Spring Framework 6.2 and Spring Security 6.5 lines it manages, delivered through your own Maven or Gradle repository manager. They are available now on the Patch, Assure and Operate tiers.
Spring Boot extended supportWhat your auditor will say
Every system component in the cardholder data environment needs its applicable security patches. A component with no upstream fix supply needs a patched source or a documented compensating control.
Auditors ask for evidence that production systems receive security fixes. A version past end of life fails that test unless another supplier ships the fixes and can show which CVEs they close.
Spring Boot 3.5: common questions
When did Spring Boot 3.5 reach end of life?
Open source support ended on 30 June 2026. spring.io lists commercial support until 30 June 2032.
What is the last open source Spring Boot 3.5 release?
3.5.16, released on 25 June 2026. It manages Spring Framework 6.2.19, Spring Security 6.5.11 and Tomcat 10.1.55.
Is any Spring Boot 3.x version still supported in open source?
No. 3.5 was the last 3.x line. Spring Boot 4.0 and 4.1 are the open source lines, and 4.0 ends on 31 December 2026.
Which CVEs affect Spring Boot 3.5.16?
Through Spring Framework 6.2.19, CVE-2026-59313, CVE-2026-47892 and CVE-2026-59283, published on NVD on 27 August 2026. Through Tomcat 10.1.55, CVE-2026-76183. The Framework fixes for 6.2 are Enterprise Support Only.
Can I get security patches for Spring Boot 3.5?
Yes. OSSeva ships patched, signed Spring Boot 3.5 artifacts on the Patch, Assure and Operate tiers.
Still running Spring Boot 3.5?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.