// Spring continuation
Spring Boot extended support for 2.x and Spring Framework 5
Spring Boot extended support keeps Spring Boot 2.7 and Spring Framework 5.3 patched after Spring ended open-source support for them on 30 June 2023 and 31 August 2024. OSSeva ships signed patched builds of the version you run, delivered through your Maven repository, so you stay covered without a forced move to Spring Boot 3 or Java 17. Email your Spring versions and we reply with what is covered.
- Past open-source support
- Boot 2.6 and 2.7, Framework 5.2 and 5.3, Security 5.7 and 5.8
- Broadcom commercial window
- 2.7, 5.2, 5.3 and Security 5.7 and 5.8 run to 30 Jun 2029
- Patch targets
- Critical within 48 hours, High within 7 days
- Your next move
- Stay patched now, upgrade to Spring Boot 4.1 on your schedule
Dates checked 20 October 2026 against api.spring.io (the data behind spring.io's support tables) and endoflife.date, which agree. Vendor facts come from each vendor's own pages, read the same day. Next review by 18 January 2027.
Trusted globally by enterprises
Which Spring lines are past open-source support
Spring Boot 2.6 and 2.7, Spring Framework 5.2 and 5.3, and Spring Security 5.7 and 5.8 have all left open-source support, and so has Spring Boot 3.5. After that date fixes ship only to Broadcom subscribers, so a team without a subscription has no upstream patch path. Dates checked 20 October 2026 on api.spring.io, which feeds spring.io's support tables, and endoflife.date.
| Line | Open-source support ended | Broadcom commercial support ends | Last public release | OSSeva patched builds |
|---|---|---|---|---|
| Spring Boot 2.6 | 30 Nov 2022 | 29 Feb 2024 (ended) | 2.6.15 | Yes |
| Spring Boot 2.7 | 30 Jun 2023 | 30 Jun 2029 | 2.7.18 | Yes |
| Spring Framework 5.2 | 31 Dec 2021 | 30 Jun 2029 | 5.2.25 | Yes |
| Spring Framework 5.3 | 31 Aug 2024 | 30 Jun 2029 | 5.3.39 | Yes |
| Spring Security 5.7 | 30 Jun 2023 | 30 Jun 2029 | 5.7.14 | Yes |
| Spring Security 5.8 | 31 Dec 2023 | 30 Jun 2029 | 5.8.16 | Yes |
| Spring Boot 3.5 (Framework 6.2) | 30 Jun 2026 | 30 Jun 2032 | 3.5.16 | Yes |
| Spring Boot 4.0 (Framework 7.0) | 31 Dec 2026 | 31 Dec 2027 | 4.0.8 | Supported |
| Spring Boot 4.1 (Framework 7.0) | 31 Jul 2027 | 31 Jul 2028 | 4.1.1 | Supported |
Sources: api.spring.io project generations and endoflife.date, checked 20 October 2026. endoflife.date lists Spring Boot 2.6 six days earlier (24 Nov 2022 and 24 Feb 2024); spring.io's dates are used. Spring Boot 2.7, 3.5 and Spring Framework 5.3 and 6.2 are the lines Spring designates for the longer commercial window. The line-by-line end-of-life pages are linked below.
Spring Boot EOL dates for every line →Spring Framework EOL dates for every line →Spring Boot 2.7 end of life →Spring Framework 5.3 end of life →
Spring CVEs since open-source support ended, and where each is fixed
OSSeva's CVE directory records 6 advisories that affect Spring Boot 2.7 and were published after 30 June 2023 (5 scored 7.0 or higher), 5 that affect Spring Framework 5.3 after 31 August 2024 (all scored 9.0 or higher), and 8 that affect Spring Security 5.7 or 5.8 after 31 December 2023 (7 scored 7.0 or higher). The last column is the fix upstream names. Where it says Enterprise Support Only, the fixed 2.7, 5.7 or 5.8 build exists only for Broadcom subscribers. For Spring Framework 5.3 every advisory below lists 5.3.49 and earlier as affected, so the first fixed 5.3 build is 5.3.50, which is not a public release.
Spring Boot 2.7 (6 advisories since 30 June 2023)
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2026-40974 | 2026-04-28 | 9.8 | 4.0.0 to 4.0.5; 3.5.0 to 3.5.13; 3.4.0 to 3.4.15; 3.3.0 to 3.3.18; 2.7.32 and earlier | 4.0.6, 3.5.14 (public); 3.4.16, 3.3.19, 2.7.33 (Enterprise Support Only) |
| CVE-2026-40975 | 2026-04-28 | 7.5 | 4.0.0 to 4.0.5; 3.5.0 to 3.5.13; 3.4.0 to 3.4.15; 3.3.0 to 3.3.18; 2.7.32 and earlier | 4.0.6, 3.5.14 (public); 3.4.16, 3.3.19, 2.7.33 (Enterprise Support Only) |
| CVE-2026-40972 | 2026-04-28 | 7.5 | 4.0.0 to 4.0.5; 3.5.0 to 3.5.13; 3.4.0 to 3.4.15; 3.3.0 to 3.3.18; 2.7.32 and earlier | 4.0.6, 3.5.14 (public); 3.4.16, 3.3.19, 2.7.33 (Enterprise Support Only) |
| CVE-2026-22733 | 2026-03-20 | 8.1 | 4.0.0 to 4.0.3; 3.5.0 to 3.5.11; 3.4.0 to 3.4.14; 3.3.0 to 3.3.17; 2.7.31 and earlier | 4.0.4, 3.5.12 (public); 3.4.15, 3.3.18, 2.7.32 (Enterprise Support Only) |
| CVE-2025-22235 | 2025-04-28 | 7.3 | 3.4.0 to 3.4.4; 3.3.0 to 3.3.10; 3.2.0 to 3.2.13.2; 3.1.0 to 3.1.15.2; 2.7.24.2 and earlier | 3.4.5, 3.3.11 (public); 3.2.14, 3.1.16, 2.7.25 (Enterprise Support Only) |
| CVE-2024-38807 | 2024-08-23 | 6.3 | 3.3.0 to 3.3.2; 3.2.0 to 3.2.8; 3.1.0 to 3.1.12; 3.0.0 to 3.0.16; 2.7.0 to 2.7.21 | 3.3.3, 3.2.9 (public); 3.1.13, 3.0.17, 2.7.22 (Enterprise Support Only) |
Spring Framework 5.3 (5 advisories since 31 August 2024)
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2026-47884 | 2026-08-27 | 9.8 | <5.2.26; >=5.3.0 <5.3.50; >=6.0.0 <6.0.31; >=6.1.0 <6.1.29 | See advisory |
| CVE-2026-47891 | 2026-08-27 | 9.8 | <5.2.26; >=5.3.0 <5.3.50; >=6.0.0 <6.0.31; >=6.1.0 <6.1.29 | See advisory |
| CVE-2026-47892 | 2026-08-27 | 9.8 | >=5.2.5 <5.2.26; >=5.3.0 <5.3.50; >=6.0.0 <6.0.31; >=6.1.0 <6.1.29 | See advisory |
| CVE-2026-59283 | 2026-08-27 | 9.1 | <5.2.26; >=5.3.0 <5.3.50; >=6.0.0 <6.0.31; >=6.1.0 <6.1.29 | See advisory |
| CVE-2026-59313 | 2026-08-27 | 9.8 | >=5.3.0 <=5.3.49; >=6.0.0 <=6.0.30; >=6.1.0 <=6.1.28; >=6.2.0 <=6.2.19 | See advisory |
Spring Security 5.7 and 5.8 (8 advisories since 31 December 2023)
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2026-59270 | 2026-08-27 | 9.1 | 5.7.0 to 5.7.25; 5.8.0 to 5.8.27; 6.4.0 to 6.4.18; 6.5.0 to 6.5.11; 7.0.0 to 7.0.6; 7.1.0 | 7.0.7; 7.1.1; 7.0.6.1, 7.1.0.1, 6.5.12, 6.4.19, 5.8.28, 5.7.26 (Enterprise Support Only) |
| CVE-2026-47842 | 2026-08-26 | 6.5 | 5.7.0 to 5.7.25; 5.8.0 to 5.8.27; 6.4.0 to 6.4.18; 6.5.0 to 6.5.11; 7.0.0 to 7.0.6; 7.1.0 | 7.0.7; 7.1.1; 7.0.6.1, 7.1.0.1, 6.5.12, 6.4.19, 5.8.28, 5.7.26 (Enterprise Support Only) |
| CVE-2026-47838 | 2026-06-10 | 8.1 | 5.7.24 and earlier; 5.8.0 to 5.8.26; 6.3.0 to 6.3.17; 6.4.0 to 6.4.17; 6.5.0 to 6.5.10 | 6.5.11; 6.5.10.2, 6.4.18, 6.3.18, 5.8.27, 5.7.25 (Enterprise Support Only) |
| CVE-2026-40988 | 2026-06-10 | 7.5 | 5.7.23 and earlier; 5.8.0 to 5.8.25; 6.3.0 to 6.3.16; 6.4.0 to 6.4.16; 6.5.0 to 6.5.10; 7.0.0 to 7.0.5 | 6.5.11; 7.0.6; 7.0.5.1, 6.5.10.2, 6.4.17, 6.3.17, 5.8.26, 5.7.24 (Enterprise Support Only) |
| CVE-2026-22732 | 2026-03-19 | 9.1 | 5.7.21 and earlier; 5.8.0 to 5.8.23; 6.3.0 to 6.3.14; 6.4.0 to 6.4.14; 6.5.0 to 6.5.8; 7.0.0 to 7.0.3 | 6.5.9; 7.0.4; 6.4.15, 6.3.15, 5.8.24, 5.7.22 (Enterprise Support Only) |
| CVE-2025-22228 | 2025-03-20 | 7.4 | 5.7.15 and earlier; 5.8.0 to 5.8.17; 6.0.0 to 6.0.15; 6.1.0 to 6.1.13; 6.2.0 to 6.2.9; 6.3.0 to 6.3.7; 6.4.0 to 6.4.3 | 6.3.8; 6.4.4; 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16 (Enterprise Support Only) |
| CVE-2024-38821 | 2024-10-28 | 9.1 | 6.3.0 to 6.3.3; 6.2.0 to 6.2.6; 6.1.0 to 6.1.10; 6.0.0 to 6.0.12; 5.8.0 to 5.8.14; 5.7.12 and earlier | 6.3.4, 6.2.7 (public); 6.1.11, 6.0.13, 5.8.15, 5.7.13 (Enterprise Support Only) |
| CVE-2024-22257 | 2024-03-18 | 8.2 | 5.7.11 and earlier; 5.8.0 to 5.8.10; 6.0.0 to 6.0.9; 6.1.0 to 6.1.7; 6.2.0 to 6.2.2 | 5.7.12; 5.8.11; 6.1.8; 6.2.3; 6.0.10 (Enterprise Support Only) |
The directory lists CVEs matched at NVD to the product, mostly scoring 7.0 or higher, so it is a subset of every Spring advisory. Counts as of 20 October 2026. Affected ranges and fixed-in versions are those in each advisory.
What Spring extended support covers
OSSeva ships patched builds of the version line you already run, so the application code, the version and the build files stay the same. Coverage is Spring Framework, Spring Boot and Spring Security, plus fixes backported to the libraries the Boot 2.7 BOM manages, such as Jackson, Netty and Logback.
| Item | What you get |
|---|---|
| Spring Boot | 2.6 and 2.7 after open-source support, and 3.0 to 3.5 as they leave it |
| Spring Framework | 5.2 and 5.3 after open-source support, and 6.0 to 6.2 as they leave it |
| Spring Security | 5.6 to 5.8 and 6.0 to 6.5, where authentication and authorization fixes matter most |
| Managed dependencies | Backported fixes for the libraries the Boot BOM manages, such as Jackson, Netty and Logback |
| Delivery | Signed patched builds as Maven artifacts, through your repository manager |
| Patch targets | Critical CVEs within 48 hours and High within 7 days (Patch tier) |
| Not in scope | Spring Data, Spring Cloud and the other Spring projects: list the versions you run and we confirm before you buy |
| Pricing model | Per application, not per developer seat. Book a discovery call for a quote |
- Patch: signed patched builds for the lines above, delivered through your repository.
- Assure: everything in Patch, plus architecture review, audit evidence, an upgrade-readiness assessment and 24/7 reactive support.
- Operate: everything in Assure, plus 24/7 managed operations with a 15-minute P1 response for the Spring applications and the brokers and databases behind them.
Spring Boot coverage →Spring Framework coverage →Spring Security coverage →How pricing works →
Broadcom commercial support versus patched builds
Five routes cover Spring Boot 2.7 and Spring Framework 5.3 after open-source support. They differ in where the fix comes from, which Spring projects they list and how long they list them. Each vendor's own page was read on 20 October 2026; where a page states no figure, the cell says so.
| Vendor | Lists for Boot 2.7 and Framework 5.3 | How it is delivered | Fits when |
|---|---|---|---|
| Broadcom (Tanzu Spring) | Commercial support to 30 Jun 2029 for Boot 2.7, Framework 5.2 and 5.3, Security 5.7 and 5.8; to 30 Jun 2032 for Boot 3.5 and Framework 6.0 to 6.2 | Fixes from the Spring maintainers, day-zero patches, private access to releases no longer under open-source support, 24x7 support for over 50 Spring projects plus OpenJDK and Tomcat | You want fixes from the project's owner and the wider Spring portfolio from one vendor |
| HeroDevs (Never-Ending Support for Spring) | Boot 1.5, 2.5, 2.7, 3.2, 3.3, 3.4 and 3.5, each with its Framework and Security versions (Boot 2.7 with Framework 5.3 and Security 5.7 and 5.8) | Packages through repository managers such as Nexus and Artifactory, or its CLI. The Spring page states no fix timings | Spring is one of several application frameworks, JavaScript included, on one contract |
| TuxCare (ELS for Spring) | Framework 5.2, 5.3, 6.0, 6.1, 6.2 and older lines; Boot 2.4, 2.6, 3.1 and 3.5. Boot 2.7 is not listed | Signed updates through Maven and Gradle, with 24/7 expert assistance on CVE triage and patch requests | Your Spring lines are on its list and you also run TuxCare for Linux and runtimes |
| OpenLogic by Perforce (LTS) | Boot 2.7 and Framework 5.3 to 31 Oct 2027; Boot 3.1 to 3.5 and Framework 6.0 to 6.2 to 30 Jun 2028 | Patches for CVSS 9+ within 14 days and CVSS 7+ within 30 days as service level objectives; contractual SLAs exist only for CentOS 7 and AngularJS | Spring is one of many technologies under one support contract and the end date fits your plan |
| OSSeva | Boot 2.6 and 2.7, Framework 5.2 and 5.3, Security 5.6 to 5.8, plus the Boot BOM's managed libraries | Signed Maven artifacts through your repository manager. Critical within 48 hours and High within 7 days; 24/7 reactive support from Assure; 15-minute P1 on Operate | You want Spring in one contract with the brokers, databases and Tomcat under it, or your line is outside Broadcom's window |
Where Broadcom is the better pick: the fix comes from the people who write Spring, it covers Spring Data, Spring Cloud and tooling OSSeva does not, and it adds OpenJDK. Where OSSeva is not the right pick: you need Spring Data or Spring Cloud versions we have not confirmed, or you want patches from the Spring maintainers. No prices appear here; every vendor in this table quotes per customer.
Spring 5 and Boot 2 extended support compared →OSSeva vs HeroDevs →OSSeva vs TuxCare →OSSeva vs OpenLogic →All extended support vendors compared →
Spring4Shell (CVE-2022-22965): which Spring builds are fixed
Spring4Shell was fixed while Spring Framework 5.3 was still in open-source support, in 5.3.18 and 5.2.20.RELEASE. A Framework build older than that is exposed on any line, so check the resolved Framework version in your dependency tree rather than the Spring Boot version. Spring Boot 2.7.18, the last public 2.7 release, requires Framework 5.3.31 or above.
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2022-22965 | 2022-04-01 | 9.8 | 5.3.0 to 5.3.17; 5.2.19.RELEASE and earlier | 5.3.18; 5.2.20.RELEASE |
Upgrade to Spring Boot 4 on your schedule
Patched builds are a bridge, not the destination. Spring Boot 3.5 is not a long stop either: its open-source support ended on 30 June 2026, Spring Boot 4.0's ends on 31 December 2026 and Spring Boot 4.1's on 31 July 2027. The move from 2.7 to 4.1 changes the baselines below. Scope depends on code volume, how many dependencies pin javax packages and each service's downtime window.
| Baseline | Spring Boot 2.7.18 | Spring Boot 4.1.1 |
|---|---|---|
| Java | Java 8; compatible up to and including Java 21 | At least Java 17; compatible up to Java 26 |
| Spring Framework | 5.3.31 or above | 7.0.9 or above |
| Embedded servlet container | Tomcat 9.0 (Servlet 4.0), Jetty 9.4 and 10.0, Undertow 2.0 | Tomcat 11.0.x or Jetty 12.1.x (Servlet 6.1) |
| Package namespace | javax.* | jakarta.* (changed in Framework 6 and Boot 3) |
Sources: docs.spring.io system requirements for Spring Boot 2.7.18 and 4.1.1, read 20 October 2026, and the Spring Framework wiki (5.3 supports JDK 8 to 21). Assure includes an upgrade-readiness assessment; Operate covers the applications while they move.
Spring Boot 3.5 to 4 upgrade →Spring Boot 2 to 3 migration guide →javax to jakarta migration →Spring Security 5.8 to 6 migration →
Is Spring Boot 3.5 still supported?
Not in open source. Spring ended open-source support for Spring Boot 3.5 on 30 June 2026, and the last public 3.5 release is 3.5.16. Broadcom's commercial support for 3.5 runs to 30 June 2032, and OSSeva ships patched 3.5 builds. Open-source support for Spring Boot 4.0 ends on 31 December 2026 and for 4.1 on 31 July 2027, so 4.1 is the longest-lived open-source target today.
Is Spring Boot 3 end of life?
Every 3.x line has now left open-source support: 3.0 on 31 December 2023, 3.1 on 30 June 2024, 3.2 on 31 December 2024, 3.3 on 30 June 2025, 3.4 on 31 December 2025 and 3.5 on 30 June 2026. Broadcom's commercial window has ended for 3.0 to 3.3, runs to 31 December 2026 for 3.4 and to 30 June 2032 for 3.5. Moving from Spring Boot 2 to 3.x therefore lands on a line that is also past open-source support.
Which Java versions are supported by Spring Boot?
It depends on the line. Spring Boot 2.7.18 requires Java 8 and is compatible up to and including Java 21, with Spring Framework 5.3.31 or above. Spring Boot 3.x and 4.x require Java 17 or later. Spring Boot 4.1.1 requires at least Java 17 and is compatible up to Java 26, with Spring Framework 7.0.9 or above. Spring Framework 5.3 supports JDK 8 to 21.
I hope there is commercial support available: who sells support for Spring Boot 2.7?
Four vendors list it. Broadcom (Tanzu Spring) sells commercial support for Spring Boot 2.7 to 30 June 2029. HeroDevs lists Spring Boot 2.7 in its Never-Ending Support for Spring. OpenLogic lists Spring Boot 2.7 in its long-term support product to 31 October 2027. OSSeva ships patched Spring Boot 2.6 and 2.7 builds. TuxCare's Spring page lists Spring Boot 2.4, 2.6, 3.1 and 3.5, but not 2.7. Each vendor's page was read on 20 October 2026; the table above sets them side by side.
Which vendors offer extended security support for Spring Framework versions that have reached end of life?
For Spring Framework 5.3, Broadcom (to 30 June 2029), HeroDevs, TuxCare, OpenLogic (to 31 October 2027) and OSSeva all list it. TuxCare also lists 5.2, 6.0, 6.1 and 6.2 and older lines. Ask any vendor to name the Spring modules and exact versions covered, because Framework, Boot, Security, Data and Cloud are covered differently from vendor to vendor.
What are the best options for organizations running end-of-life Spring and Java versions that cannot migrate immediately?
There are three: buy Broadcom's commercial support if you want fixes from the Spring maintainers, buy patched builds of the same version line from a third party such as OSSeva so nothing in your build changes, or upgrade in stages. The options are not exclusive: patched builds keep the application covered while a staged upgrade to Spring Boot 4.1 runs. The JDK underneath is a separate layer with its own vendors.
Does Spring4Shell affect Spring Framework 5.3 and Spring Boot 2.7?
Only builds older than the fix. Spring4Shell (CVE-2022-22965) affects Spring Framework 5.3.0 to 5.3.17 and 5.2.19.RELEASE and earlier, and is fixed in 5.3.18 and 5.2.20.RELEASE. Spring Boot 2.7.18, the last public 2.7 release, requires Framework 5.3.31 or above, so it is past the fix. Check your resolved Framework version, not just the Boot version.
How are fixes delivered, how fast, and how is it priced?
Patched builds of the version you already run are signed and delivered as Maven artifacts through your repository manager, so the application's code and version line do not change. On the Patch tier, Critical CVEs are fixed within 48 hours and High within 7 days. Spring support is priced per application, not per developer seat. Email your versions for a quote.
Get a quote
Stay patched until you are ready to upgrade.
Send your Spring versions. We tell you which lines are covered and what the first patched build looks like.
Prefer to talk or read more first?