OSSEVA FOR SPRING SECURITY
Community Spring Security support for 5.x has ended. Your auth layer didn't get safer.
OSSeva provides Spring Security support for 5.6.x to 7.1.x, including patched builds for 5.6.x to 5.8.x and 6.0.x to 6.5.x after the community stops fixing them. Authentication and authorization vulnerabilities are the most severe class of application CVEs. OSSeva maintains CVE coverage for Spring Security 5.7.x and 5.8.x — the versions protecting most enterprise Spring applications today.
Reply within 1 business day · No commitment · or book a 15-minute call
Which vendors provide patched Spring Security after end of life? Spring Boot Extended Support for 2.x and Spring Framework 5.
Last reviewed
Trusted globally by enterprises
Why now
Spring Security 5.x community EOL: December 2023
All Spring Security 5.x versions reached community end-of-life in December 2023. Any new authentication bypass, CSRF, or authorization vulnerability discovered after that date has no upstream patch path.
Auth/authz CVEs carry the highest compliance risk
Authentication and authorization vulnerabilities in Spring Security map directly to PCI DSS Requirement 6, HIPAA §164.312, and SOC 2 CC6. An unpatched auth layer is an automatic finding in most compliance audits.
Spring Security 6.x requires Jakarta namespace migration
Upgrading to Spring Security 6.x requires migrating from javax.* to jakarta.* namespaces — a non-trivial change that touches every layer of a Spring application. OSSeva covers 5.x while your team executes that migration.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 5.6.x(Full CVE coverage) | Extended | Clean |
| 5.7.x(Full CVE coverage) | Extended | Clean |
| 5.8.x(Full CVE coverage) | Extended | Clean |
| 6.0.x(STS, community EOL — OSSeva patched) | EOL | 1 open |
| 6.1.x(STS, community EOL — OSSeva patched) | EOL | Clean |
| 6.2.x(Community EOL — OSSeva patched) | EOL | Clean |
| 6.3.x(Community EOL — OSSeva patched) | EOL | Clean |
| 6.4.x(Community EOL — OSSeva patched) | EOL | Clean |
| 6.5.x(Community EOL — OSSeva patched) | EOL | Clean |
| 7.0.x(OSS support ends 31 Dec 2026) | Current | Clean |
| 7.1.x | Current | Clean |
Running a Spring Security version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for Spring Security 5.x. Authentication layer protection.
- Quarterly CVE patches for Spring Security 5.6.x–5.8.x
- Emergency patches for authentication bypass CVEs
- Maven Central / private repo delivery
- Signed artifacts (GPG)
- CVE disclosure notifications
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus security configuration audit and compliance documentation.
- Everything in Patch
- Spring Security configuration audit
- OAuth 2.0 / OIDC configuration review
- SOC 2 / PCI DSS attestation package
- Spring Security 6 migration assessment
- Pen-test validation summary
- 24/7 reactive support
OSSeva Operate
Full MSP with security event monitoring and named engineers.
- Everything in Assure
- 24/7 auth event monitoring and alerting
- 15-minute P1 response for auth bypass incidents
- Named senior Spring Security engineer
- Session management and token security reviews
- Quarterly security posture reviews
- Spring Security 6 migration execution
All tiers priced per cluster/application — not per core.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
<dependency>
<groupId>io.osseva.spring</groupId>
<artifactId>spring-security-core</artifactId>
<version>5.8.12-osseva-1</version>
</dependency>
<dependency>
<groupId>io.osseva.spring</groupId>
<artifactId>spring-security-web</artifactId>
<version>5.8.12-osseva-1</version>
</dependency>dependencies {
implementation "io.osseva.spring:spring-security-core:5.8.12-osseva-1"
implementation "io.osseva.spring:spring-security-web:5.8.12-osseva-1"
implementation "io.osseva.spring:spring-security-config:5.8.12-osseva-1"
}Migrate from Broadcom Spring Commercial
Broadcom commercialized Spring Security alongside the broader Spring ecosystem. OSSeva provides continuation coverage for 5.x with a structured path to Spring Security 6 when your Jakarta namespace migration is complete.
Pricing model
OSSeva for Spring Security is typically bundled with Spring Boot and Spring Framework coverage. Book a discovery call for a quote.
Which Spring Security modules does OSSeva cover?
OSSeva covers the full Spring Security module set: spring-security-core, spring-security-web, spring-security-config, spring-security-oauth2-client, spring-security-oauth2-resource-server, and spring-security-ldap.
Are authentication bypass CVEs treated differently?
Yes. Any CVE that enables authentication bypass or privilege escalation is treated as a P1 — emergency patch within 48 hours, immediate notification to all active customers, and direct engineer escalation for Operate-tier customers.
Do we need to change our Spring Security configuration when switching to OSSeva builds?
No. OSSeva patches are binary-compatible with upstream Spring Security 5.x. Your security configuration — FilterChain, UserDetailsService, OAuth2 configuration — remains unchanged.
Does OSSeva cover Spring Security's OAuth2 / OIDC integration?
Yes. The OAuth 2.0 and OIDC client and resource server modules are included in OSSeva coverage. Token validation, JWKS endpoint handling, and authorization server integration vulnerabilities are all in scope.
What does the Spring Security 6 migration assessment include?
The Assure-tier assessment covers: javax to jakarta namespace impact analysis, WebSecurityConfigurerAdapter removal scope, HttpSecurity lambda DSL migration, and Spring Security 6 configuration pattern recommendations for your application.
Who provides Spring Security support besides Broadcom?
Broadcom commercialized Spring Security alongside the broader Spring ecosystem, so later fixes sit in its commercial builds. Other routes are managed application platforms that include Spring and third-party support companies. OSSeva is a third-party option: one contract across your runtime, database and messaging stack, end-of-life Spring Security versions included, and Maven Central or private repo delivery wherever you run Spring.
Does OSSeva support current Spring Security versions or only end-of-life ones?
Both. OSSeva's support matrix lists 5.6.x to 5.8.x as extended, 6.0.x to 6.5.x as community end of life with OSSeva patches active, and 7.0.x and 7.1.x as current with patches active. Assure adds a Spring Security 6 migration assessment, and Operate includes migration execution.
How is OSSeva Spring Security support priced?
OSSeva Spring Security support is typically bundled with Spring Boot and Spring Framework coverage, which is priced per application. Patch covers quarterly CVE patches, Assure adds 24/7 reactive support, a configuration audit and compliance documentation, and Operate adds proactive 24/7 monitoring and managed operations with a 15-minute P1 SLA. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days. Book a discovery call for a quote.
Get a quote
Ready to get Spring Security patched and supported?
Tell us your Spring Security versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?