Backend framework
Spring Boot: supported versions and open vulnerabilities today
Spring Boot 4.1 and 4.0 are supported (4.0 until Dec 31, 2026); 3.5 reached end of life on Jun 30, 2026; the latest release is 4.1.1. 2 high or critical advisories for Spring Boot were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 4.1.1
- GitHub stars
- 81.6k
- Licence
- Apache-2.0
- OpenSSF Scorecard
- 6.9 / 10
Supported versions
Security advisories
3 advisories published in the last 12 months, 2 of them high or critical. 8 in total since records began. Checked packages: org.springframework.boot:spring-boot, org.springframework.boot:spring-boot-autoconfigure and org.springframework.boot:spring-boot-actuator.
Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
Fixed in 4.0.6.
Affects org.springframework.boot:spring-boot.
EPSS: top 56%Spring Boot accepts predictable temp directory without ownership verification
Fixed in 3.5.14 and 4.0.6.
Affects org.springframework.boot:spring-boot.
EPSS: top 98%
All org.springframework.boot:spring-boot advisories on OSV.devAll org.springframework.boot:spring-boot-autoconfigure advisories on OSV.devAll org.springframework.boot:spring-boot-actuator advisories on OSV.dev
Maintenance and supply chain
OpenSSF Scorecard 6.9 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 9 issue updates found in the last 90 days.
Weakest checks
- No OpenSSF best-practices badge (CII-Best-Practices 0/10)
- Little code review (Code-Review 1/10)
- No branch protection (Branch-Protection 3/10)
Alternatives
Express.js
Minimal Node.js web framework
Strengths
- Lightweight and flexible
- Huge ecosystem
Trade-offs
- Minimal built-in features
- Manual setup required
Django
High-level Python web framework with batteries included
Strengths
- Comprehensive built-in features (ORM, admin, auth)
- Secure by default (CSRF, SQL injection protection)
Trade-offs
- Monolithic and opinionated
- Slower than lightweight frameworks
FastAPI
Modern Python framework for building APIs with type hints
Strengths
- Extremely fast performance (on par with Node/Go)
- Automatic API documentation (OpenAPI/Swagger)
Trade-offs
- Younger ecosystem than Django/Flask
- Less built-in features than Django
Ruby on Rails
Full-stack web framework emphasizing convention over configuration
Strengths
- Convention over configuration (rapid development)
- Rich ecosystem of gems (libraries)
Trade-offs
- Slower runtime performance than competitors
- Monolithic architecture can be restrictive
Docs and release notes
Check Spring Boot in your own stack
This page checks Spring Boot in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.