Spring Security end of life dates
Spring Security 7.1 is the newest release line, at 7.1.1 (20 Aug 2026). 2 lines are still supported upstream: 7.1 and 7.0. 16 lines have reached end of life, most recently 6.5 on 30 Jun 2026. 7.0 is next, on 31 Dec 2026. OSSeva ships patched builds for end-of-life Spring Security 6.5, 6.4, 6.3, 6.2, 6.1, 6.0, 5.8, 5.7 and 5.6.
- Latest release
- 7.1.1
- Supported lines
- 2
- End-of-life lines
- 16
- Next end of life
- 7.0 · 31 Dec 2026
Spring Security release timeline
All Spring Security versions and end-of-life dates
| Version | Released | OSS support | Commercial Support | Latest | OSSeva |
|---|---|---|---|---|---|
| 7.1 | 4 months ago(9 Jun 2026) | Ends in 10 months(31 Jul 2027) | Ends in 1 year and 10 months(31 Jul 2028) | 7.1.1 | – |
| 7.0 | 10 months ago(17 Nov 2025) | Ends in 3 months(31 Dec 2026) | Ends in 1 year and 3 months(31 Dec 2027) | 7.0.7 | – |
| 6.5 | 1 year and 4 months ago(19 May 2025) | Ended 3 months ago(30 Jun 2026) | Ends in 5 years and 9 months(30 Jun 2032) | 6.5.11 | Patched |
| 6.4 | 1 year and 10 months ago(18 Nov 2024) | Ended 9 months ago(31 Dec 2025) | Ends in 3 months(31 Dec 2026) | 6.4.13 | Patched |
| 6.3 | 2 years and 4 months ago(20 May 2024) | Ended 1 year and 3 months ago(30 Jun 2025) | Ended 3 months ago(30 Jun 2026) | 6.3.10 | Patched |
| 6.2 | 2 years and 10 months ago(20 Nov 2023) | Ended 1 year and 9 months ago(31 Dec 2024) | Ended 9 months ago(31 Dec 2025) | 6.2.8 | Patched |
| 6.1 | 3 years and 5 months ago(15 May 2023) | Ended 2 years and 3 months ago(30 Jun 2024) | Ended 1 year and 3 months ago(30 Jun 2025) | 6.1.9 | Patched |
| 6.0 | 3 years and 10 months ago(21 Nov 2022) | Ended 2 years and 9 months ago(31 Dec 2023) | Ended 1 year and 9 months ago(31 Dec 2024) | 6.0.8 | Patched |
| 5.8 | 3 years and 10 months ago(21 Nov 2022) | Ended 2 years and 9 months ago(31 Dec 2023) | Ends in 2 years and 9 months(30 Jun 2029) | 5.8.16 | Patched |
| 5.7 | 4 years and 5 months ago(16 May 2022) | Ended 3 years and 3 months ago(30 Jun 2023) | Ends in 2 years and 9 months(30 Jun 2029) | 5.7.14 | Patched |
| 5.6 | 4 years and 10 months ago(16 Nov 2021) | Ended 3 years and 10 months ago(30 Nov 2022) | Ended 2 years and 7 months ago(29 Feb 2024) | 5.6.12 | Patched |
| 5.5 | 5 years and 4 months ago(18 May 2021) | Ended 4 years and 4 months ago(31 May 2022) | Ended 3 years and 1 month ago(31 Aug 2023) | 5.5.8 | – |
| 5.4 | 6 years and 1 month ago(9 Sept 2020) | Ended 4 years and 10 months ago(30 Nov 2021) | Ended 3 years and 7 months ago(28 Feb 2023) | 5.4.10 | – |
| 5.3 | 6 years and 7 months ago(4 Mar 2020) | Ended 5 years and 4 months ago(31 May 2021) | Ended 4 years and 1 month ago(31 Aug 2022) | 5.3.13 | – |
| 5.2 | 7 years ago(1 Oct 2019) | Ended 5 years and 11 months ago(31 Oct 2020) | Ended 4 years and 8 months ago(31 Jan 2022) | 5.2.15 | – |
| 5.1 | 7 years and 11 months ago(31 Oct 2018) | Ended 6 years and 11 months ago(31 Oct 2019) | Ended 5 years and 8 months ago(31 Jan 2021) | 5.1.13 | – |
| 5.0 | 8 years and 6 months ago(31 Mar 2018) | Ended 7 years and 6 months ago(31 Mar 2019) | Ended 6 years and 3 months ago(30 Jun 2020) | 5.0.19 | – |
| 4.2 | 9 years and 8 months ago(31 Jan 2017) | Ended 7 years and 1 month ago(31 Aug 2019) | Ended 5 years and 10 months ago(30 Nov 2020) | 4.2.20 | – |
Lifecycle data from endoflife.date (MIT licence), refreshed 30 Sept 2026. Upstream policy: github.com. “Patched” marks end-of-life lines OSSeva ships signed, backported builds for.
Running an end-of-life Spring Security version?
OSSeva keeps end-of-life Spring Security patched with signed builds and backported CVE fixes, documents it for your auditor, and can run it for you, so the upgrade happens on your schedule rather than the project’s.
Spring Security extended supportSpring Security end of life: common questions
What is the latest Spring Security version?
7.1.1, released 20 Aug 2026, on the 7.1 line. Other supported lines: 7.0.
When is the next Spring Security end of life?
Spring Security 7.0 reaches the end of oss support on 31 Dec 2026. After that date the project stops shipping security fixes for 7.0, and CVEs disclosed later stay unpatched upstream.
Which Spring Security versions are still supported?
7.1 (until 31 Jul 2027) and 7.0 (until 31 Dec 2026). Every other line has reached end of life, per the dates in the table above.
Can I get security patches for an end-of-life Spring Security version?
Yes. OSSeva ships signed builds with backported CVE fixes for Spring Security 6.5, 6.4, 6.3, 6.2, 6.1, 6.0, 5.8, 5.7 and 5.6 after upstream support ends, on the Patch, Assure and Operate tiers, so you can stay on the version you run while you plan the upgrade.
Still running an end-of-life Spring Security?
Tell us the versions and the estate size. We will tell you whether to upgrade or keep it patched, and what each costs.