Spring Framework 5.3 end of life
Spring Framework 5.3 ended open-source support on 31 August 2024. It was the final 5.x line and the last to support Java 8. The final open-source release was 5.3.39. Commercial support from Broadcom continues beyond that date under a paid subscription; without one, Spring Framework 5 receives no upstream security patches.
- End of life
- 31 August 2024 (OSS support)
- Released
- Oct 2020
- Final release
- 5.3.39
- Successor
- Spring Framework 6.2 or 7.0
Date published by Spring Framework support policy. We do not publish a lifecycle date we cannot source.
What actually stops on 31 August 2024
- Open-source patch releases on the 5.3 line. 5.3.39 was the last.
- Security fixes for the core container, Spring MVC, Spring WebFlux and the data access layers in the 5.x tree.
- Any prospect of Java 21 or later compatibility. Spring Framework 5.3 is the last line that supports Java 8, and it will not be updated for newer JDKs.
What actually breaks in the upgrade
The Java 8 tie is the reason estates are stuck
Spring Framework 5.3 is the last version that runs on Java 8. Spring Framework 6 requires Java 17. That single fact is why Spring 5 estates and Java 8 estates are usually the same estate, and why the migration is a programme rather than a version bump.
Jakarta EE again
Spring Framework 6 moves to Jakarta EE, so every javax.servlet, javax.persistence and javax.validation import changes. In a large codebase this is mechanical but wide, and it has to land atomically with the dependency upgrades that follow the same rename.
Scope creep is the risk, not difficulty
'Spring' can mean Framework, Boot, Security, Data, Batch, Integration, Cloud and more. Teams that scope a 'Spring upgrade' without naming which projects are in scope routinely discover the work is several times what they estimated. Enumerate the projects and versions before committing to a date — and expect any vendor quoting you support to do the same.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Spring Framework 6.2 | Java 17 floor plus the Jakarta namespace migration across the whole codebase. | Months for a large estate | Engineering time | The right destination. Enumerate which Spring projects are in scope before estimating. |
| Commercial Spring subscription | Broadcom paid support, now packaged with Spring Enterprise and TrueSource. | Procurement | Core-based minimums | Clean if the estate justifies the minimum commitment. |
| Extended support on Spring Framework 5.3 | Backported CVE fixes to the 5.3 line, scoped to named modules. | Days to onboard | Subscription | The practical answer for an estate that also has to move off Java 8 first. |
| Stay unpatched | No upstream fixes since August 2024. | None | Zero now | Spring is the application framework; its CVEs tend to be remotely reachable. Poor place to carry risk. |
What OSSeva does for Spring Framework 5.3
OSSeva patches this line
OSSeva backports CVE fixes to Spring Framework 5.3, delivered as signed Maven artifacts. We name the modules in the agreement rather than saying 'Spring', because Spring is millions of lines across dozens of projects and an unscoped promise helps nobody. If a module is outside what we can safely patch, we say so before you sign.
Spring Framework extended supportWhat your auditor will say
Requirement 6.3.3 applied to the application framework. Spring CVEs are typically remotely reachable, which raises the severity in most assessments.
CC7.1, with the added evidence problem that Spring CVEs are heavily publicised and reliably flagged by scanners.
Spring Framework 5.3: common questions
When did Spring Framework 5 reach end of life?
Open-source support for Spring Framework 5.3, the final 5.x line, ended on 31 August 2024. The last open-source release was 5.3.39. Commercial support from Broadcom continues under a paid subscription.
Is Spring Framework 5 still supported?
Not in open source. Commercial Spring support from Broadcom and third-party extended support are the remaining patch sources.
Why is Spring Framework 5 tied to Java 8?
Spring Framework 5.3 is the last line that supports Java 8; Spring Framework 6 requires Java 17 as a minimum. That is why Java 8 estates and Spring 5 estates are usually the same estate and have to be migrated together.
What is involved in upgrading Spring Framework 5 to 6?
A Java 17 minimum and the Jakarta EE namespace migration, moving every javax.servlet, javax.persistence and javax.validation import to jakarta.*. Mechanical but wide, and it has to land together with the dependency upgrades that follow the same rename.
Can I get security patches for Spring Framework 5.3?
Yes. Broadcom sells commercial Spring support, and third-party providers including OSSeva backport CVE fixes to the 5.3 line. Ask any provider to name the specific Spring modules covered rather than accepting 'Spring support' as a scope.
What does 'Spring support' actually cover?
It depends entirely on the vendor, and this is the question worth pressing. Spring spans Framework, Boot, Security, Data, Batch, Integration and Cloud. A quote that does not enumerate modules is a quote that will be renegotiated when you raise a ticket.
Still running Spring Framework 5.3?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.