OSSEVA FOR SPRING BOOT
Spring Boot support for 2.x, 3.x and 4.x, on your timeline.
OSSeva provides Spring Boot support for 2.6.x, 2.7.x, 3.0.x to 3.5.x, 4.0.x and 4.1.x, including patched builds for 2.6.x to 3.5.x after open source support for those lines ends. No forced Spring Boot 3 migration. No Java 17 requirement. Your timeline.
Reply within 1 business day · No commitment · or book a 15-minute call
Which vendors provide patched Spring Boot after end of life? Spring Boot Extended Support for 2.x and Spring Framework 5.
Last reviewed
Trusted globally by enterprises
Why now
Spring Boot 2.x community EOL: 30 June 2023
Open source support for Spring Boot 2.7, the last 2.x line, ended on 30 June 2023, and the final community release, 2.7.18, shipped in November 2023. Critical CVEs discovered after that date have no upstream patch path — but your auditor's checklist hasn't changed.
Spring Boot 3 requires Java 17 minimum
Upgrading from Spring Boot 2.x to 3.x requires Java 17 as the minimum JDK, plus Spring Security reconfiguration, Jakarta namespace migrations, and dependency compatibility validation. How long it takes depends on application count, code volume, how many dependencies need upgrading, and each service's downtime window.
Spring Expression Language is a recurring critical-severity surface
SpEL evaluation has produced repeated remote code execution advisories across Spring's history, and it sits in the request path wherever expressions are resolved from user-controllable input. Spring Framework 5.3.x reached OSS end of life on 31 August 2024, so advisories in this class are no longer fixed upstream for the branch Spring Boot 2.x depends on.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 2.6.x(Full CVE coverage) | Extended | Clean |
| 2.7.x(Full CVE coverage) | Extended | Clean |
| 3.0.x(STS, community EOL — OSSeva patched) | EOL | 2 open |
| 3.1.x(STS, community EOL — OSSeva patched) | EOL | 1 open |
| 3.2.x(Community EOL — OSSeva patched) | EOL | Clean |
| 3.3.x(Community EOL — OSSeva patched) | EOL | Clean |
| 3.4.x(Community EOL — OSSeva patched) | EOL | Clean |
| 3.5.x(Community EOL — OSSeva patched) | EOL | Clean |
| 4.0.x(OSS support ends 31 Dec 2026) | Current | Clean |
| 4.1.x | Current | Clean |
Running a Spring Boot version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for Spring Boot 2.x. Signed artifacts, repo manager delivery.
- Quarterly CVE patches for Spring Boot 2.6.x and 2.7.x
- Spring Framework 5.3.x patches included
- Maven Central / private repo delivery
- Signed artifacts (GPG + Sigstore)
- CVE disclosure notifications within 24 hours
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus audit documentation and Spring 3 migration planning.
- Everything in Patch
- SOC 2 / HIPAA / PCI attestation package
- Spring Boot 3 migration readiness assessment
- Java version upgrade sequencing plan
- Spring Security reconfiguration guidance
- Annual architecture review
- 24/7 reactive support
OSSeva Operate
Full MSP: monitoring, 15-min SLA, named Spring engineers.
- Everything in Assure
- 24/7 application performance monitoring
- 15-minute P1 incident response SLA
- Named senior Spring engineer on your account
- Dependency vulnerability scanning (transitive)
- Quarterly business reviews
- Spring Boot 3 migration execution support
All tiers priced per cluster/application — not per core.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
<dependencyManagement>
<dependencies>
<dependency>
<groupId>io.osseva.spring</groupId>
<artifactId>spring-boot-dependencies</artifactId>
<version>2.7.18-osseva-2</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>repositories {
maven {
url "https://artifacts.osseva.io/maven"
credentials {
username System.getenv("OSSEVA_USER")
password System.getenv("OSSEVA_TOKEN")
}
}
}
dependencies {
implementation platform("io.osseva.spring:spring-boot-dependencies:2.7.18-osseva-2")
implementation "org.springframework.boot:spring-boot-starter-web"
}Migrate from Broadcom Spring Commercial
Broadcom commercialized the Spring ecosystem in 2023. OSSeva provides continuation coverage for the community versions your applications run today — with a clear migration path to Spring Boot 3 when your team is ready.
Pricing model
OSSeva for Spring Boot is priced per application — not per developer seat or per deployment unit. Book a discovery call for a quote.
Is OSSeva's Spring Boot 2.x support a fork?
No. OSSeva applies CVE patches to the upstream Apache-licensed Spring Boot source code. Your application continues to run real Spring Boot. No proprietary runtime, no fork.
Do I need to change my pom.xml or build.gradle significantly?
Minimal changes. You update the artifact coordinates to point to the OSSeva registry and update the version to the patched build (e.g., 2.7.18-osseva-2). Your application dependencies remain unchanged.
Does OSSeva also patch Spring Framework 5.x (the foundation of Spring Boot 2.x)?
Yes. Spring Boot 2.x depends on Spring Framework 5.3.x. OSSeva patches both. CVEs in the Spring Framework layer are covered by your Spring Boot 2.x OSSeva subscription.
We're not ready for Spring Boot 3 / Java 17. How long can we stay on 2.x?
OSSeva provides extended support for as long as your business needs it. We work with customers on continuation engagements that run for as long as their teams need to plan and run the Spring Boot 3 migration.
What compliance documentation is included?
OSSeva Assure customers receive per-CVE remediation narratives, patch attestation letters citing SOC 2 CC7.1, PCI DSS 6.3.3, HIPAA §164.308, and ISO 27001 A.12.6.1, plus a pen-test validation summary.
Can you help us migrate from Spring Boot 2.x to 3.x when we're ready?
Yes. OSSeva Assure includes a Spring Boot 3 migration readiness assessment. OSSeva Operate includes full migration execution support — namespace migrations, dependency compatibility, Spring Security reconfiguration, and JDK upgrade sequencing.
Who provides Spring Boot support besides Broadcom?
Broadcom commercialized the Spring ecosystem in 2023 and sells Spring commercial support. Other options are the support that comes with a managed application platform, if your applications run on one, and third-party support companies. OSSeva is a third-party option: one contract across your Java and data stack, end-of-life Spring Boot lines included, delivered through Maven Central or your private repository manager, wherever your applications run.
Does OSSeva support current Spring Boot versions or only end-of-life ones?
Both. Of the Spring Boot supported versions upstream, OSSeva covers 4.0.x and 4.1.x, and open source support for 4.0.x ends on 31 December 2026. OSSeva also ships patched builds for 2.6.x, 2.7.x and 3.0.x to 3.5.x, which no longer get community fixes. OSSeva Operate adds 24/7 application performance monitoring and a 15-minute P1 incident response SLA.
How is OSSeva Spring Boot support priced?
Per application, not per developer seat or per deployment unit. The tier sets what is included: Patch for signed CVE patches, Assure for audit documentation and Spring Boot 3 migration planning, and Operate for 24/7 monitoring with a named Spring engineer. Book a discovery call for a quote.
Get a quote
Ready to get Spring Boot patched and supported?
Tell us your Spring Boot versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?