Security support for end-of-life Spring Framework
Free support for Spring Framework 5.3 ended on 31 August 2024; since then, fixes go only to customers of the commercial support. These are the last open-source releases of 4.3, 5.2 and 5.3, with every vulnerability the US National Vulnerability Database lists for them.
Request a server assessmentSpring Framework versions past open-source support
| Spring Framework | Release | Open-source support ended | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|---|
| 4.3.30 | Last Spring Framework 4.3 release | 31 December 2020 | 23 | 5 | 1 | Patch on order, 48 h |
| 5.2.25 | Last Spring Framework 5.2 release | 31 December 2021 | 20 | 5 | 0 | Patch on order, 48 h |
| 5.3.39 | Last Spring Framework 5.3 release | 31 August 2024 | 37 | 6 | 0 | Patch on order, 48 h |
Vulnerabilities from the US National Vulnerability Database, 28 October 2026, for the upstream version, counting only entries where Spring Framework itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Your assessment shows which of them are real on your systems.
Java libraries
Spring Framework, Spring Boot, Apache Tomcat and Log4j: the versions past end of life and what affects them. All Java libraries
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans