On behalf of the team and everyone who has contributed, I am pleased to announce that Spring Framework 6.2.18 and 7.0.7 are available now.

Spring Framework 6.2.18 ships with 27 fixes and documentation improvements. This version will be shipped next week with Spring Boot 3.5.14. Spring Framework 7.0.7 ships with 52 fixes and documentation improvements. This version will be shipped next week with Spring Boot 4.0.6.

CVE Reports:

This release addresses:

• CVE-2026-22740 "Spring Framework DoS with Multipart Temp Files in WebFlux"
• CVE-2026-22741 "Static resource cache poisoning in Spring MVC and WebFlux"
• CVE-2026-22745 "Denial of service in static resource handling on Windows platforms"

Open source support for Spring Framework 5.3.x and 6.1.x generations has ended, see our support page for more information. This fix has been applied to the 5.3.46 and 6.1.24 commercial releases, available now.

If you are not a commercial customer, please consider upgrading to an open source supported version at your earliest convenience. Commercial customers using Spring Boot 2.7, 3.1, or 3.2 can make use of Spring Boot Hotfix releases 2.7.32.1, 3.3.18.1 and 3.4.15.1. Releases are available now on the Spring commercial artifact repository and can be accessed with a Spring Enterprise Subscription.

Project Page | GitHub | Issues | Documentation