On behalf of the team and everyone who has contributed, I am pleased to announce that Spring Security 6.2.8 and 6.3.5 are out! In all cases, the releases are mostly composed of bug fixes, dependency upgrades, and documentation improvements.

Importantly, these releases address CVE-2024-38827.

To learn more, please visit the 6.2.8 and 6.3.5 release summaries.

Commercial customers using Spring Boot 2.7, 3.0, or 3.1 can update to Spring Boot 2.7.22.5, 3.0.17.5, or 3.1.13.5 respectively to receive the corresponding Security releases 5.7.14, 6.0.14, and 6.1.12. These hotfix versions are available now on the Spring commercial artifact repository and can be accessed with a Spring Enterprise Subscription.

Project Site | Reference | Help