OSSEVA FOR SPRING BOOT
Spring Boot 2.x reached EOL. Your workloads didn't.
OSSeva ships CVE patches for Spring Boot 2.6.x and 2.7.x — the versions running in production at most Fortune 500 enterprises. No forced Spring Boot 3 migration. No Java 17 requirement. Your timeline.
Last reviewed
Trusted globally by enterprises
Why now
Spring Boot 2.x community EOL: 30 June 2023
Open source support for Spring Boot 2.7, the last 2.x line, ended on 30 June 2023, and the final community release, 2.7.18, shipped in November 2023. Critical CVEs discovered after that date have no upstream patch path — but your auditor's checklist hasn't changed.
Spring Boot 3 requires Java 17 minimum
Upgrading from Spring Boot 2.x to 3.x requires Java 17 as the minimum JDK, plus Spring Security reconfiguration, Jakarta namespace migrations, and dependency compatibility validation. For most enterprises, that's a 6–18 month project.
Spring Expression Language is a recurring critical-severity surface
SpEL evaluation has produced repeated remote code execution advisories across Spring's history, and it sits in the request path wherever expressions are resolved from user-controllable input. Spring Framework 5.3.x reached OSS end of life on 31 August 2024, so advisories in this class are no longer fixed upstream for the branch Spring Boot 2.x depends on.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 2.6.x(Full CVE coverage) | Extended | Clean |
| 2.7.x(Full CVE coverage) | Extended | Clean |
| 3.0.x(STS, community EOL — OSSeva patched) | EOL | 2 open |
| 3.1.x(STS, community EOL — OSSeva patched) | EOL | 1 open |
| 3.2.x(Community EOL — OSSeva patched) | EOL | Clean |
| 3.3.x(Community EOL — OSSeva patched) | EOL | Clean |
| 3.4.x(Community EOL — OSSeva patched) | EOL | Clean |
| 3.5.x(Community EOL — OSSeva patched) | EOL | Clean |
| 4.0.x(OSS support ends 31 Dec 2026) | Current | Clean |
| 4.1.x | Current | Clean |
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for Spring Boot 2.x. Signed artifacts, repo manager delivery.
- Quarterly CVE patches for Spring Boot 2.6.x and 2.7.x
- Spring Framework 5.3.x patches included
- Maven Central / private repo delivery
- Signed artifacts (GPG + Sigstore)
- CVE disclosure notifications within 24 hours
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus audit documentation and Spring 3 migration planning.
- Everything in Patch
- SOC 2 / HIPAA / PCI attestation package
- Spring Boot 3 migration readiness assessment
- Java version upgrade sequencing plan
- Spring Security reconfiguration guidance
- Annual architecture review
- 24/7 managed operations
OSSeva Operate
Full MSP: monitoring, 15-min SLA, named Spring engineers.
- Everything in Assure
- 24/7 application performance monitoring
- 15-minute P1 incident response SLA
- Named senior Spring engineer on your account
- Dependency vulnerability scanning (transitive)
- Quarterly business reviews
- Spring Boot 3 migration execution support
All tiers priced per cluster/application — not per core. Contact for pricing →
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
<dependencyManagement>
<dependencies>
<dependency>
<groupId>io.osseva.spring</groupId>
<artifactId>spring-boot-dependencies</artifactId>
<version>2.7.18-osseva-2</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>repositories {
maven {
url "https://artifacts.osseva.io/maven"
credentials {
username System.getenv("OSSEVA_USER")
password System.getenv("OSSEVA_TOKEN")
}
}
}
dependencies {
implementation platform("io.osseva.spring:spring-boot-dependencies:2.7.18-osseva-2")
implementation "org.springframework.boot:spring-boot-starter-web"
}Migrate from Broadcom Spring Commercial
Broadcom commercialized the Spring ecosystem in 2023. OSSeva provides continuation coverage for the community versions your applications run today — with a clear migration path to Spring Boot 3 when your team is ready.
Pricing model
OSSeva for Spring Boot is priced per application — not per developer seat or per deployment unit. Book a discovery call for a quote.
Frequently asked questions
Is OSSeva's Spring Boot 2.x support a fork?
No. OSSeva applies CVE patches to the upstream Apache-licensed Spring Boot source code. Your application continues to run real Spring Boot. No proprietary runtime, no fork.
Do I need to change my pom.xml or build.gradle significantly?
Minimal changes. You update the artifact coordinates to point to the OSSeva registry and update the version to the patched build (e.g., 2.7.18-osseva-2). Your application dependencies remain unchanged.
Does OSSeva also patch Spring Framework 5.x (the foundation of Spring Boot 2.x)?
Yes. Spring Boot 2.x depends on Spring Framework 5.3.x. OSSeva patches both. CVEs in the Spring Framework layer are covered by your Spring Boot 2.x OSSeva subscription.
We're not ready for Spring Boot 3 / Java 17. How long can we stay on 2.x?
OSSeva provides extended support for as long as your business needs it. We work with customers on 12-, 24-, and 36-month continuation engagements while their teams plan the Spring Boot 3 migration.
What compliance documentation is included?
OSSeva Assure customers receive per-CVE remediation narratives, patch attestation letters citing SOC 2 CC7.1, PCI DSS 6.3.3, HIPAA §164.308, and ISO 27001 A.12.6.1, plus a pen-test validation summary.
Can you help us migrate from Spring Boot 2.x to 3.x when we're ready?
Yes. OSSeva Assure includes a Spring Boot 3 migration readiness assessment. OSSeva Operate includes full migration execution support — namespace migrations, dependency compatibility, Spring Security reconfiguration, and JDK upgrade sequencing.
Ready to get Spring Boot patched and supported?
Start with a 45-minute discovery call. We confirm your version coverage, scope the engagement, and have you onboarded within your first quarter.