The CVE you least want sitting in your auth layer
Spring Security 5.x went end of life alongside Spring Framework 5.3. An unpatched CVE in the authentication and authorization layer is a different severity conversation from one anywhere else in the stack.
Challenge
Spring Security's version is bound to the Spring Framework and Boot lines around it, so it cannot be upgraded independently. An application stuck on Framework 5.3 is stuck on Security 5.x -- which is precisely the component where an unpatched advisory matters most.
Environment
Spring Security 5.x inside applications on Spring Framework 5.3 or Spring Boot 2.7, past community end of life.
Approach
OSSeva patches Spring Security in step with the Framework and Boot lines it is pinned to, so the auth layer is not the component left behind by the version matrix.
What this delivers
The authentication and authorization layer patched on the version the application is actually pinned to.