# OSSeva Patch — CVE Remediation for EOL Open Source

OSSeva Patch provides commercial CVE patching for open-source runtimes that have reached community end-of-life, without requiring a major version migration.

## What Is Included

- Quarterly CVE patches for all covered versions
- Out-of-cycle patches for CVSS 9.0+ vulnerabilities within 48 hours of disclosure
- GPG-signed and Sigstore-attested artifacts
- Delivery via Helm, Maven Central, OCI registry, or private repo
- Integration with Artifactory, Nexus, and Harbor
- SBOM (CycloneDX / SPDX) per release
- Erlang/OTP, JVM, and glibc compatibility validation
- Version compatibility matrix (runtime + OS)
- Vulnerability disclosure notifications

## Supported Technologies

RabbitMQ 3.11–4.x, Apache Kafka 2.8–3.7, PostgreSQL 11–16, Spring Framework 5.2–6.1, Spring Boot 2.7–3.x, Apache Tomcat 8.5–10.x, Redis 6.x–7.x, ActiveMQ Artemis, Apache ZooKeeper, Elasticsearch/OpenSearch, Keycloak, HashiCorp Vault, NGINX.

## Delivery Format

Artifacts are delivered to your existing repo manager (Artifactory, Nexus, Harbor) or via OCI-compatible registry pull. No agents installed in your environment.

## Pricing

All pricing requires a discovery call. No pricing is published on this site.

[Book a discovery call →](/contact)