OSSEVA FOR SPRING FRAMEWORK
Community Spring Framework support for 5.x has ended. Your applications have not.
OSSeva provides Spring Framework support for 5.2.x, 5.3.x, 6.0.x to 6.2.x and 7.0.x, including patched builds for 5.x and 6.0.x to 6.2.x after open source support ends. It ships CVE patches for 5.3.x and earlier past the community EOL date — with migration design to 6.x and compliance documentation for your auditors.
Reply within 1 business day · No commitment · or book a 15-minute call
Which vendors provide patched Spring Framework after end of life? Spring Boot Extended Support for 2.x and Spring Framework 5.
Last reviewed
Trusted globally by enterprises
Why now
Spring Framework 5.3.x: OSS EOL 31 August 2024
Open source support for Spring Framework 5.3.x ended on 31 August 2024 (final OSS release 5.3.39). Later fixes ship only in Broadcom's commercial builds. OSSeva ships patched 5.3.x builds with backported CVE fixes.
Migration to Spring 6 requires Java 17+
Spring Framework 6.x requires Java 17 as the baseline. Many enterprise applications are still on Java 11 or 8. The migration is real work — OSSeva gives your team time to do it safely.
Spring Commercial is a commercial product now
Spring Commercial (from Broadcom/VMware) requires a commercial subscription for extended Spring support. OSSeva provides the same CVE-patched continuity under an OSS-compatible contract.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 5.2.x | Extended | Clean |
| 5.3.x | Extended | Clean |
| 6.0.x(Community EOL — OSSeva patched) | EOL | Clean |
| 6.1.x(Community EOL — OSSeva patched) | EOL | Clean |
| 6.2.x(Community EOL — OSSeva patched) | EOL | Clean |
| 7.0.x | Current | Clean |
Running a Spring Framework version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE remediation for Spring 5.x past community EOL.
- Quarterly CVE patches for covered versions
- Maven Central compatible artifacts
- Vulnerability disclosure notifications
- Migration planning
- Architecture review
OSSeva Assure
Patches plus 5.x → 6.x migration design and compliance docs.
- Everything in Patch
- Spring 5→6 migration roadmap
- Dependency compatibility audit
- Compliance attestation package
- Spring Security coverage included
- 24/7 reactive support
OSSeva Operate
Application-tier managed operations for your Spring fleet.
- Everything in Assure
- JVM performance monitoring
- 15-minute P1 incident response SLA
- Named engineer on your account
- Migration execution support
All tiers priced per cluster/application — not per core.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
<dependency>
<groupId>io.osseva.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>5.3.39-osseva-1</version>
</dependency>implementation("io.osseva.springframework:spring-core:5.3.39-osseva-1")Do your Spring 5.x artifacts replace Spring Commercial from Broadcom?
Yes. OSSeva for Spring Framework provides CVE-patched 5.3.x artifacts that are drop-in replacements for both upstream Spring and Spring Commercial. No Broadcom subscription required.
Is Spring Boot also covered?
Spring Boot 2.x (which uses Spring Framework 5.x) is a separate OSSeva offering — OSSeva for Spring Boot. Both are frequently purchased together.
Who provides Spring Framework support besides Broadcom?
Broadcom controls the Spring project, publishes the open source releases and ships later fixes only in its commercial Spring builds. Other routes are managed application platforms that include Spring and third-party support companies. OSSeva is a third-party option: one contract across your runtime, database and messaging stack, end-of-life Spring versions included, and Maven Central compatible artifacts that run wherever you run Spring.
Does OSSeva support current Spring Framework versions or only end-of-life ones?
Both. OSSeva's support matrix lists 5.2.x and 5.3.x as extended, 6.0.x, 6.1.x and 6.2.x as community end of life with OSSeva patches active, and 7.0.x as current with patches active. Assure adds a Spring 5 to 6 migration plan and a dependency compatibility audit, and Operate includes migration execution support.
How is OSSeva Spring Framework support priced?
OSSeva Spring Framework support is priced per application. Patch covers quarterly CVE patches for the covered versions, Assure adds 24/7 reactive support, a Spring 5 to 6 migration plan and Spring Security coverage, and Operate adds proactive 24/7 monitoring and managed operations with a 15-minute P1 SLA. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days. Book a discovery call for a quote.
Get a quote
Ready to get Spring Framework patched and supported?
Tell us your Spring Framework versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?