On behalf of the team and everyone who has contributed, I'm happy to announce that Spring LDAP 4.2.0-RC1 is available now from Maven Central. Make sure to checkout the What's New section of the documentation. Release Notes Milestone Thanks to all who contributed with issue reports and pull requests. As always, we welcome your feedback on GitHub. Project Page | GitHub | Issues | Documentation
On behalf of the team and everyone who has contributed, I'm happy to announce the following maintenance releases of Spring LDAP, available now from Maven Central: 4.0.6 (release notes) 4.1.2 (release notes) Thanks to all who contributed with issue reports and pull requests. As always, we welcome your feedback on GitHub. Project Page | GitHub | Issues | Documentation
On behalf of the team and everyone who has contributed, I'm happy to announce that Spring Security 7.2.0-RC1 is available now from Maven Central. Make sure to checkout the What's New section of the documentation. Release Notes Milestone Thanks to all who contributed with issue reports and pull requests. As always, we welcome your feedback on GitHub. Project Page | GitHub | Issues | Documentation
On behalf of the team and everyone who has contributed, I'm happy to announce the following maintenance releases of Spring Security, available now from Maven Central: 7.0.8 (release notes) 7.1.2 (release notes) Thanks to all who contributed with issue reports and pull requests. As always, we welcome your feedback on GitHub. Project Page | GitHub | Issues | Documentation
On behalf of the team and everyone who has contributed, I'm happy to announce that Spring Session 4.2.0-RC1 is available now from Maven Central. Release Notes Milestone Thanks to all who contributed with issue reports and pull requests. As always, we welcome your feedback on GitHub. Project Page | GitHub | Issues | Documentation
On behalf of the team and everyone who has contributed, I'm happy to announce that Spring LDAP 4.2.0-M1 has been released and is now available from Maven Central. This release includes 33 enhancements, documentation improvements, dependency upgrades, and bug fixes. Notable new features include: DirContextAdapter post-processing support for LdapClient Remove-by-value customization support Thanks to all those who have contributed with issue reports and pull requests. How can you help? If you're interested in helping out, check out the "ideal for contribution" tag in the issue repository.
If you…
On behalf of the team and everyone who has contributed, I am pleased to announce the availability of Spring Security 6.5.11, 7.0.6, and 7.1.0. These releases address the following CVEs: CVE-2026-40988 "Unbounded DEFLATE Inflation in SAML 2.0 Service Provider" CVE-2026-40993 "Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry" CVE-2026-41003 "Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting" CVE-2026-41694 "SAML Payloads Decrypted Without Valid Signature" CVE-2026-41706 "Open Redirect When Using CookieRequestCache" CVE-202…
On behalf of the team and everyone who has contributed, I am pleased to announce the availability of Spring LDAP 3.3.8, 4.0.4, and 4.1.0. These releases address the following CVE: CVE-2026-41720 "Authentication Bypass with Empty Password in Spring LDAP" For the 4.1.0 release, please check out the main feature set in our What's New in Spring LDAP 4.1 page. For a complete list of changes, refer to the changelogs: 3.3.8 4.0.4 4.1.0 Commercial Releases Open source support for Spring LDAP 2.4.x and 3.2.x generations has ended, see our support page for more information.
Commercial customers can…
On behalf of the team and everyone who has contributed, I am pleased to announce the availability of Spring Security 6.5.10, 7.0.5, and 7.1.0-RC1. These releases address the following CVEs: CVE-2026-22746 "User Attribute Enumeration when Using DaoAuthenticationProvider" CVE-2026-22747 "Unauthorized User Impersonation when Using X.509 Client Certificates" CVE-2026-22748 "Potential Security Misconfiguration when Using withIssuerLocation" CVE-2026-22753 "Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers" CVE-2026-22754 "Servlet Path Not Correctly Included in…
In 2013, it was proposed to add multi-factor authentication into Spring Security. That was the year that “selfie” was added to the English dictionary and “What Does the Fox Say?” was a viral YouTube hit. Needless to say, one of the biggest features in Spring Security 7 is a long time coming, and is our next stop along our Road to GA. What is Multi-Factor Authentication (MFA)? Multi-Factor Authentication is an authentication strategy by which your identity is determined on a website by more than one means of verification, or factor. Common factors fall into one of a few categories: Something…
