On behalf of the team and everyone who has contributed, I am pleased to announce the availability of Spring Security 6.4.10 and 6.5.4.

Spring Security 6.4.10 ships with 4 fixes and several dependency upgrades. This version will be shipped this week with Spring Boot 3.4.10.

Spring Security 6.5.4 ships with 4 fixes and several dependency upgrades. This version will be shipped this week with Spring Boot 3.5.6.

These two releases also address CVE-2025-41248, which was announced in conjunction with CVE-2025-41249.

See Spring Security and Spring Framework Release Fixes for CVE-2025-41248 and CVE-2025-41249 for further details.

Project Page | GitHub | Issues | Documentation