Security support for end-of-life Spring Boot
Free support for Spring Boot 2.7, the last 2.x line, has ended; fixes go only to customers of the commercial support. These are the last open-source releases of 1.5, 2.5 and 2.7, with every vulnerability the US National Vulnerability Database lists for them.
Request a server assessmentSpring Boot versions past open-source support
| Spring Boot | Release | Open-source support ended | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|---|
| 1.5.22 | Last Spring Boot 1.5 release | 6 August 2019 | 9 | 1 | 0 | Patch on order, 48 h |
| 2.5.15 | Last Spring Boot 2.5 release | 19 May 2022 | 6 | 0 | 0 | Patch on order, 48 h |
| 2.7.18 | Last Spring Boot 2.7 release | 30 June 2023 | 7 | 0 | 0 | Patch on order, 48 h |
Vulnerabilities from the US National Vulnerability Database, 28 October 2026, for the upstream version, counting only entries where Spring Boot itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Your assessment shows which of them are real on your systems.
Java libraries
Spring Framework, Spring Boot, Apache Tomcat and Log4j: the versions past end of life and what affects them. All Java libraries
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans