On behalf of the team and everyone who has contributed, I am pleased to announce that Spring Boot 2.7.25, 3.1.16, 3.2.14, 3.3.11, and 3.4.5 are available now, which fix CVE-2025-22235.

Please refer to the releases page for more details.

Commercial customers using Spring Boot 2.7, 3.1, or 3.2 will be able to update to Spring Boot 2.7.25, 3.1.16, or 3.2.14 respectively. These Spring Boot versions are available now on the Spring commercial artifact repository and can be accessed with a Spring Enterprise Subscription.

Project Page | GitHub | Issues | Documentation