We're please to announce the relase of Spring Security 2.0.8, 3.0.8, and 3.1.3 which fixes CVE-2012-5055 and brings Spring Security's open bugs to 0. The releases are available from the Spring Community Downloads area and jars are available from Maven central repository. See the project website for more information.

A special thanks to Nicholas Goodwin (@NGoody) for disclosing the issue and keeping it private until a fix could be pushed out.

3.1.3: Changelog | Download | 3.1.3 Reference Manual | FAQ

3.0.8: Changelog | Download | Reference Manual

2.0.8: Changelog | Download | Reference Manual