Spring Boot 3.2.x Release Notes

11 versions

Comprehensive release notes and changelog for Spring Boot 3.2.x, including security patches, bug fixes, and feature updates across all supported versions.

Feb 25, 2026

Latest: 3.2.23

5 Patched Vulnerabilities

VEX Statements

February 2026

3.2.23

Released on Feb 25, 2026

Full Version:

3.2.12-spring-boot-3.2.23

Bug Fixes

Fixed TLSv1.3 cipher configuration being silently ignored after Tomcat 10.1.52 upgrade. Applications that configured TLSv1.3 ciphers via server.ssl.ciphers or via options.ciphers in an SSL Bundle would have those ciphers silently dropped, falling back to all default ciphers.
- See our blog post for details: Silent TLS Cipher Downgrade in Spring Boot.

Dependency Upgrades

Jakarta XML Bind 4.0.5
Jetty 12.0.32
Netty 4.1.131.Final
Tomcat 10.1.52
Undertow 2.3.23.Final
jOOQ 3.18.37

January 2026

3.2.22

Released on Jan 28, 2026

Full Version:

3.2.12-spring-boot-3.2.22

Dependency Upgrades

Dropwizard Metrics 4.2.38
Groovy 4.0.30
Jaybird 5.0.11.java11
Pooled JMS 3.1.9
R2DBC MSSQL 1.0.4.RELEASE
Undertow 2.3.22.Final

December 2025

3.2.21

Released on Dec 18, 2025

Full Version:

3.2.12-spring-boot-3.2.21

Dependency Upgrades

AspectJ 1.9.25.1
Jetty 12.0.31
Netty 4.1.130.Final
Pooled JMS 3.1.8
Spring LDAP (NES) 3.2.16-spring-ldap-3.2.18
Spring WS 4.0.17
Tomcat 10.1.50
jOOQ 3.18.36

November 2025

3.2.20

Released on Nov 21, 2025

Full Version:

3.2.12-spring-boot-3.2.20

Dependency Upgrades

AspectJ 1.9.25
Jetty 12.0.30
Jetty Reactive HTTPClient 4.0.13
R2DBC Postgresql 1.0.9.RELEASE
Tomcat 10.1.49
jOOQ 3.18.35

October 2025

3.2.19

Released on Oct 24, 2025

Full Version:

3.2.12-spring-boot-3.2.19

Dependency Upgrades

Angus Mail 2.0.5
Glassfish JAXB 4.0.6
Groovy 4.0.29
Jaybird 5.0.10.java11
Jetty 12.0.29
Jetty Reactive HTTPClient 4.0.12
MSSQL JDBC 12.4.3.jre11
Netty 4.1.128.Final
R2DBC H2 1.0.1.RELEASE
R2DBC Postgresql 1.0.8.RELEASE
RxJava3 3.1.12
Spring AMQP (NES) 3.1.12-spring-amqp-3.1.16
Spring Authorization Server (NES) 1.2.7-spring-authorization-server-1.2.11
Spring Batch (NES) 5.1.3-spring-batch-5.1.8
Spring Data Bom (NES) 2023.1.12-spring-data-bom-2023.1.15
Spring Framework (NES) 6.1.21-spring-framework-6.1.25
Spring HATEOAS (NES) 2.2.5-spring-hateoas-2.2.9
Spring Integration (NES) 6.2.11-spring-integration-6.2.17
Spring Kafka (NES) 3.1.10-spring-kafka-3.1.14
Spring LDAP (NES) 3.2.13-spring-ldap-3.2.17
Spring Pulsar (NES) 1.0.12-spring-pulsar-1.0.16
Spring Security (NES) 6.2.8-spring-security-6.2.13
Spring Session (NES) 3.2.7-spring-session-3.2.11
Spring WS 4.0.16
Tomcat 10.1.48
Undertow 2.3.20.Final
jOOQ 3.18.34

September 2025

3.2.18

Released on Sep 30, 2025

Full Version:

3.2.12-spring-boot-3.2.18

Dependency Upgrades

Spring Batch (NES) 5.1.3-spring-batch-5.1.7
Spring Integration (NES) 6.2.11-spring-integration-6.2.16

3.2.17

Released on Sep 23, 2025

Full Version:

3.2.12-spring-boot-3.2.17

Dependency Upgrades

Dropwizard Metrics 4.2.37
Ehcache3 3.10.9
Jakarta Activation 2.1.4
Jakarta Mail 2.1.5
Jakarta XML Bind 4.0.4
Jetty 12.0.27
jOOQ 3.18.33
Lombok 1.18.42
Netty 4.1.127.Final
R2DBC MSSQL 1.0.3.RELEASE
Spring AMQP (NES) 3.1.12-spring-amqp-3.1.15
Spring Authorization Server (NES) 1.2.7-spring-authorization-server-1.2.10
Spring Batch (NES) 5.1.3-spring-batch-5.1.6
Spring Data BOM (NES) 2023.1.12-spring-data-bom-2023.1.15
Spring Framework (NES) 6.1.21-spring-framework-6.1.24
Spring HATEOAS (NES) 2.2.5-spring-hateoas-2.2.8
Spring Integration (NES) 6.2.11-spring-integration-6.2.15
Spring Kafka (NES) 3.1.10-spring-kafka-3.1.13
Spring LDAP (NES) 3.2.13-spring-ldap-3.2.16
Spring Pulsar (NES) 1.0.12-spring-pulsar-1.0.15
Spring Security (NES) 6.2.8-spring-security-6.2.12
Spring Session (NES) 3.2.7-spring-session-3.2.10
Tomcat 10.1.46
Undertow 2.3.19.Final

August 2025

3.2.16

Released on Aug 25, 2025

Full Version:

3.2.12-spring-boot-3.2.16

Dependency Updates

Angus Mail 2.0.4
Groovy 4.0.28
Hibernate Validator 8.0.3.Final
Infinispan 14.0.35.Final
Jaybird 5.0.9.java11
Jersey 3.1.11
Jetty 12.0.24
Jetty Reactive HTTPClient 4.0.11
jOOQ 3.18.32
Netty 4.1.123.Final
RxJava3 3.1.11
Spring AMQP (NES) 3.1.12-spring-amqp-3.1.14
Spring Authorization Server (NES) 1.2.7-spring-authorization-server-1.2.9
Spring Batch (NES) 5.1.3-spring-batch-5.1.5
Spring Data Bom 202(NES) 3.1.12-spring-data-bom-2023.1.14
Spring Framework (NES) 6.1.21-spring-framework-6.1.23
Spring GraphQL (NES) 1.2.9-spring-graphql-1.2.11
Spring HATEOAS (NES) 2.2.5-spring-hateoas-2.2.7
Spring Integration (NES) 6.2.11-spring-integration-6.2.13
Spring Kafka (NES) 3.1.10-spring-kafka-3.1.12
Spring LDAP (NES) 3.2.13-spring-ldap-3.2.15
Spring Pulsar (NES) 1.0.12-spring-pulsar-1.0.14
Spring RESTDocs 3.0.5
Spring Security (NES) 6.2.8-spring-security-6.2.11
Spring Session (NES) 3.2.7-spring-session-3.2.9
Tomcat 10.1.44

July 2025

3.2.15

Released on Jul 15, 2025

Full Version:

3.2.12-spring-boot-3.2.15

Dependency Upgrades

Dropwizard Metrics 4.2.33
Jaybird 5.0.8.java11
Jetty 12.0.23
jOOQ 3.18.31
Netty 4.1.122.Final
Reactor Bom 2023.0.19
Spring AMQP (NES) 3.1.12-spring-amqp-3.1.13
Spring Authorization Server (NES) 1.2.7-spring-authorization-server-1.2.8
Spring Batch (NES) 5.1.3-spring-batch-5.1.4
Spring Data BOM (NES) 2023.1.12-spring-data-bom-2023.1.13
Spring Framework (NES) 6.1.21-spring-framework-6.1.22
Spring GraphQL (NES) 1.2.9-spring-graphql-1.2.10
Spring HATEOAS (NES) 2.2.5-spring-hateoas-2.2.6
Spring Kafka (NES) 3.1.10-spring-kafka-3.1.11
Spring LDAP (NES) 3.2.13-spring-ldap-3.2.14
Spring Pulsar (NES) 1.0.12-spring-pulsar-1.0.13
Spring RESTDocs 3.0.4
Spring Security (NES) 6.2.8-spring-security-6.2.10
Spring Session (NES) 3.2.7-spring-session-3.2.8
Spring WS 4.0.15
Tomcat 10.1.42

May 2025

3.2.14

Released on May 29, 2025

Full Version:

3.2.12-spring-boot-3.2.14

Dependency Upgrades

Dropwizard Metrics 4.2.32
Groovy 4.0.27
Jetty Reactive HTTPClient 4.0.10
Spring Framework 6.1.20
Spring Retry 2.0.12
Spring WS 4.0.14

3.2.13

Released on May 27, 2025

CVE-2025-22235

Full Version:

3.2.12-spring-boot-3.2.13

Bug Fixes

Patches a bug where an incorrect matcher is generated by Spring Boot Actuator's EndpointRequest.to() when the Actuator endpoint is not exposed. (CVE-2025-22235).
- org.springframework.boot:spring-boot-actuator-autoconfigure:3.2.12-spring-boot-3.2.13

Notes

This release originates from the open‑source Spring Boot repository forked by HeroDevs. This release contains no functional changes from Spring Boot 3.2.12.

Dependency Upgrades

ActiveMQ 5.18.7
AspectJ 1.9.24
Commons Pool2 2.12.1
Dependency Management Plugin 1.1.7
Dropwizard Metrics 4.2.30
FreeMarker 2.3.34
Groovy 4.0.26
Hibernate Validator 8.0.2.Final
Infinispan 14.0.34.Final
Jaybird 5.0.7.java11
Jersey 3.1.10
Jetty 12.0.21
Jetty Reactive HTTPClient 4.0.9
jOOQ 3.18.30
Json-smart 2.5.2
Lombok 1.18.38
MariaDB 3.3.4
Maven Deploy Plugin 3.1.4
Maven Install Plugin 3.1.4
Netty 4.1.121.Final
Pulsar Reactive 0.5.10
R2DBC Proxy 1.1.6.RELEASE
Reactor Bom 2023.0.18
RSocket 1.1.5
RxJava3 3.1.10
SLF4J 2.0.17
Spring AMQP 3.1.11
Spring Batch 5.1.3
Spring Framework 6.1.19
Spring Integration (NES) 6.2.11-spring-integration-6.2.12
Spring LDAP 3.2.12
Spring Retry 2.0.11
Spring Security (NES) 6.2.8-spring-security-6.2.9
Spring Session 3.2.7
Spring WS 4.0.13
Thymeleaf 3.1.3.RELEASE
Thymeleaf Extras SpringSecurity 3.1.3.RELEASE
Tomcat 10.1.41Full Version: 3.2.12-spring-boot-3.2.13

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.

New releases published regularly — check back often for the latest security updates

$ cat features.txt

Security Patches
Regular updates to keep your applications secure
CVE Remediation
Rapid response to critical vulnerabilities
Expert Support
Direct access to our development team