Spring Framework 6 end of life
Spring Framework 6 is out of open source support. Its last line, 6.2, reached the end of open source support on 30 June 2026, after 6.0 in June 2024 and 6.1 in June 2025. spring.io lists commercial support for all three until 30 June 2032. The last open source release is 6.2.19, from 8 June 2026. Spring Framework 7.0 is supported to 31 July 2027.
- End of life
- 30 June 2026
- Released
- Nov 2022
- Final release
- 6.2.19 (last open source release, 8 June 2026)
- Successor
- Spring Framework 7.0
Date published by spring.io Spring Framework generations. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 30 June 2026
- Open source 6.x releases. 6.2.19 is the last; 6.0 and 6.1 stopped earlier.
- Open source fixes for new advisories. CVE-2026-59313 and CVE-2026-47892, rated 9.8 by NVD, and CVE-2026-59283, rated 9.1, affect 6.2.0 to 6.2.19 as well as 6.0 and 6.1. spring.io lists the 6.2.20, 6.1.29 and 6.0.31 fixes as Enterprise Support Only.
- Open source releases of Spring Boot 3.5 and Spring Security 6.5, the lines built on 6.2, which ended on the same day.
What actually breaks in the upgrade
Most teams move Framework through Boot
Spring Boot 3.5 manages Framework 6.2, and Boot 4.0 and 4.1 manage Framework 7.0. For a Boot application the practical upgrade is Boot 3.5 to 4.1, which brings Framework 7.0, Security 7.1 and Jakarta EE 11 APIs together.
Read the August 2026 advisories first
CVE-2026-59313 affects Spring MVC functional endpoints that use Server-Sent Events. CVE-2026-47892 affects WebFlux functional endpoints deployed with DispatcherServlet. CVE-2026-59283 affects SpEL with SimpleEvaluationContext when the expression compiler is active. Check which of these code paths you use before deciding how urgent the move is.
7.0 has its own date
Spring Framework 7.0 open source support ends on 31 July 2027, and spring.io lists 7.1 with a first release on 30 November 2026. Plan the next step while doing this one.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Spring Framework 7.0 | Usually by moving Spring Boot from 3.5 to 4.1. | Weeks to months | Engineering time | The supported path, open source to 31 July 2027. |
| OSSeva patched Spring Framework 6 | Signed 6.0, 6.1 and 6.2 artifacts with backported fixes. | Days | Subscription | Closes the August 2026 CVEs without waiting for the Boot 4 programme. |
| Broadcom commercial support | Commercial 6.x releases, listed to 30 June 2032. | Procurement | Commercial subscription | A long vendor date, on Broadcom's terms. |
| Stay on 6.2.19 | No open source fixes since June 2026. | None | Zero now | Three advisories rated 9.1 or higher are already open against it. |
What OSSeva does for Spring Framework 6
OSSeva patches this line
OSSeva ships patched, signed Spring Framework 6.0, 6.1 and 6.2 artifacts with backported fixes, including the August 2026 advisories, delivered through your own repository manager. They are available now on the Patch, Assure and Operate tiers.
Spring Framework extended supportWhat your auditor will say
Every system component in the cardholder data environment needs its applicable security patches. A component with no upstream fix supply needs a patched source or a documented compensating control.
Auditors ask for evidence that production systems receive security fixes. A version past end of life fails that test unless another supplier ships the fixes and can show which CVEs they close.
Spring Framework 6: common questions
When did Spring Framework 6 reach end of life?
Open source support for 6.2, the last 6.x line, ended on 30 June 2026. 6.1 ended on 30 June 2025 and 6.0 on 30 June 2024. spring.io lists commercial support for all three until 30 June 2032.
What is the last open source Spring Framework 6 release?
6.2.19, released on 8 June 2026.
Which Spring Boot version uses Spring Framework 6.2?
Spring Boot 3.5. Spring Boot 4.0 and 4.1 use Spring Framework 7.0.
Which CVEs affect Spring Framework 6.2.19?
CVE-2026-59313, CVE-2026-47892 and CVE-2026-59283, all published on NVD on 27 August 2026. spring.io lists the 6.2 fix, 6.2.20, as Enterprise Support Only.
Can I get security patches for Spring Framework 6?
Yes. OSSeva ships patched, signed 6.0, 6.1 and 6.2 artifacts on the Patch, Assure and Operate tiers.
Still running Spring Framework 6?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.