Security support for end-of-life Java libraries

Spring Framework 5.3 and Spring Boot 2.7 left open-source support, Tomcat 8.5 reached end of life in March 2024 and Log4j 1.x in 2015. Applications built on them keep running. We backport the fixes to the versions inside them.

Request a server assessment

What we keep patched

Spring Framework

4.3, 5.2 and 5.3, past open-source support. Spring4Shell status for each.

Spring Boot

1.5, 2.5 and 2.7, and the libraries they pull in.

Apache Tomcat

7, 8.0 and 8.5. Ghostcat status for each.

Log4j

1.2.17, still inside many Java applications. Log4Shell status.

Versions and their known vulnerabilities

Product	Version	End of life	Known CVEs	Critical	Exploited	Forkward
Spring Framework	4.3.30	31 December 2020	23	5	1	Patch on order, 48 h
Spring Framework	5.2.25	31 December 2021	20	5	0	Patch on order, 48 h
Spring Framework	5.3.39	31 August 2024	37	6	0	Patch on order, 48 h
Spring Boot	1.5.22	6 August 2019	9	1	0	Patch on order, 48 h
Spring Boot	2.5.15	19 May 2022	6	0	0	Patch on order, 48 h
Spring Boot	2.7.18	30 June 2023	7	0	0	Patch on order, 48 h
Apache Tomcat	7.0.109	31 March 2021	22	9	1	Patch on order, 48 h
Apache Tomcat	8.0.53	30 June 2018	7	2	1	Patch on order, 48 h
Apache Tomcat	8.5.100	31 March 2024	29	11	1	Patch on order, 48 h
Log4j	1.2.17		6	3	0	Patch on order, 48 h

Vulnerabilities from the US National Vulnerability Database for each exact version. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. End-of-life dates from each project, via endoflife.date. Your assessment shows which risks are real on your systems.

NIS2 and DORA

Both expect you to handle known vulnerabilities. Our fixes and their public status give your auditor an answer for every old system you keep. What each law asks

Patch on order, 48 h

We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans