Spring End-of-Life Resource Hub
End of life doesn’t have to mean end of support. Find strategies, resources, and solutions for keeping your Spring applications stable, secure, and compliant.
.png)
.png)
Featured Articles
Browse expert insights, industry news, analyses, and how-tos on navigating Spring and Java end-of-life transitions.
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
![CVE-2024-38828: DoS via Spring MVC Controller Method with byte[] Parameter](https://cdn.prod.website-files.com/62876589ec366575fa309b1e/673e0f6a7971ec7d5afa92c9_CVE-2024-38828.png)
.png)
.png)
.png)
.png)
.png)
.png)
10 Tomcat CVEs to Watch Out for in 2025 (Patched by HeroDevs NES)
From RCE to DoS, these 2025 Apache Tomcat vulnerabilities target versions still widely used in production. HeroDevs NES neutralizes the threat.
Never-Ending Support Now Covers Spring Boot 3.2 and 3.4
Secure Spring Boot 3.2 & 3.4 Beyond End-of-Life with Never-Ending Support
Never-Ending Support Now Covers Spring Boot 3.2 and 3.4
Secure Spring Boot 3.2 & 3.4 Beyond End-of-Life with Never-Ending Support
Explore CVEs on EOL Java Versions
Monitor and learn more about known vulnerabilities in legacy Java and Spring versions to assess risk exposure.
Severity
ID
Technology
Libraries Affected
Category
Version(s) Affected
Published Date
Medium
Spring
Spring Framework
Privilege Abuse
>=5.3.0 <=5.3.44, >=6.0.0 <=6.0.29, >=6.1.0 <6.1.23, >=6.2.0 <6.2.11
Sep 22, 2025
High
Angular
@angular/platform-server, @angular/ssr, @nguniversal/common
Information Exposure
@angular/platform-server, =16.0.0-next.0 <18.2.14, >=19.0.0-next.0 <19.2.15, >=20.0.0-next.0 <20.3.0, >=21.0.0-next.0 <21.0.0-next.3, @angular/ssr, =17.0.0-next.0 <18.2.21, >=19.0.0-next.0 <19.2.16, >=20.0.0-next.0 <20.3.0, >=21.0.0-next.0 <21.0.0-next.3, @nguniversal/common, =16.0.0-next.0
Sep 11, 2025
Critical
Spring
Spring Cloud Gateway
Incorrectly Configured Access Control
>=3.1.0 <=3.1.9, >=4.0.0 <=4.0.9, >=4.1.0 <=4.1.9, >=4.2.0 <4.2.5, >=4.3.0 <4.3.1
Sep 10, 2025
Medium
Spring
Spring Framework
Path Traversal
>=4.3.0 <=4.3.30, >=5.3.0 <=5.3.43, >=6.0.0 <=6.0.29, >=6.1.0 <=6.1.21, >=6.2.0 <=6.2.9
Aug 18, 2025
High
Struts
Apache Commons Beanutils
Remote Code Execution
>=1.0 <1.11, >=2.0.0-M1 <2.0.0-M2
Aug 4, 2025
High
Struts
Apache Commons Fileupload
Denial of Service
>=1.0 <1.6.0, >=2.0.0-M1 <2.0.0-M
Aug 4, 2025
High
Apache Tomcat
Apache Tomcat
Path Traversal
>=9.0.0.M1 <9.0.105, >=10.1.0-M1 <10.1.41, >=11.0.0-M1 <11.0.7
Aug 4, 2025
Critical
Apache Tomcat
Apache Tomcat
Command Injection
>=9.0.76 <9.0.104, >=10.1.10 <10.1.40, >=11.0.0-M2 <11.0.6
Aug 4, 2025
Critical
Apache Tomcat
Apache Tomcat
Remote Code Execution
>=9.0.0.M1 <9.0.99, >=10.1.0-M1 <10.1.35, >=11.0.0-M1 <11.0.3
Jul 30, 2025
Medium
Apache Tomcat
Apache Tomcat
Denial of Service
>=9.0.0.M1 <9.0.107, >=10.1.0-M1 <10.1.43, >=11.0.0-M1 <11.0.9
Jul 30, 2025
Featured Whitepaper
Deep-dive reports and technical briefings on migration, risk, and long-term Java strategy.
Java in 2025:
Navigating Migration, Security, and Long-Term Risk
The question for CIOs, CISOs, and engineering leaders is no longer whether to continue relying on Java. It is how to migrate safely between LTS versions, reduce exposure in legacy environments, and implement governance frameworks that withstand regulatory scrutiny.This white paper provides detailed analysis of migration realities, real-world breach lessons, supply-chain risk, and the economic, regulatory, and vendor dynamics shaping enterprise decisions in 2025.
Ready to Eliminate EOL Risk?
Start scanning your codebase today. Identify every end-of-life package in minutes, not hours.
CVEs Explained
Go under the hood of major Spring and Java CVEs as our team dissects the exploit, explains the patch, and shows you how to defend your stack.
CVE-2025-48976
Denial of Service
High
Project Affected:
Apache Commons Fileupload in Struts
Versions:
>=1.0 <1.6.0
>=2.0.0-M1 <2.0.0-M
CVE-2025-46701
Path Traversal
High
Project Affected:
Apache Tomcat in Apache Tomcat
Versions:
>=9.0.0.M1 <9.0.105
>=10.1.0-M1 <10.1.41
>=11.0.0-M1 <11.0.7
CVE-2025-31651
Command Injection
Critical
Project Affected:
Apache Tomcat in Apache Tomcat
Versions:
>=9.0.76 <9.0.104
>=10.1.10 <10.1.40
>=11.0.0-M2 <11.0.6
CVE-2025-48734
Remote Code Execution
High
Project Affected:
Apache Commons Beanutils in Struts
Versions:
>=1.0 <1.11
>=2.0.0-M1 <2.0.0-M2
Migration Stories
Read real use cases and lessons learned from teams migrating legacy and end-of-life OSS systems.
10 Tomcat CVEs to Watch Out for in 2025 (Patched by HeroDevs NES)
10 Tomcat CVEs to Watch Out for in 2025 (Patched by HeroDevs NES)
10 Tomcat CVEs to Watch Out for in 2025 (Patched by HeroDevs NES)
10 Tomcat CVEs to Watch Out for in 2025 (Patched by HeroDevs NES)
