HeroDevs
Visit NES for Spring Home Page

Spring Framework 4.3.x Release Notes

10 versions

Comprehensive release notes and changelog for Spring Framework 4.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Aug 25, 2026
Latest: 4.3.40
60 Patched Vulnerabilities
VEX Statements

August 2026

4.3.40

Released Aug 25, 2026
CVE-2026-59314
CVE-2026-59282
CVE-2026-59281
CVE-2026-47886
CVE-2026-59283
3 More
Full Version: 
4.3.30-spring-framework-4.3.40

Security Fixes

  • Control characters in a multipart form field name or filename are no longer written unfiltered into the Content-Disposition header by HttpHeaders.setContentDispositionFormData, so a CR or LF can no longer corrupt the message framing (low severity, CVE-2026-59314).
  • A self-populating List can no longer bypass the auto-grow collection limit configured on AbstractNestablePropertyAccessor during attacker-controlled property-path traversal (medium severity, CVE-2026-59282).
  • Unescaped rejected values and messages are no longer exposed to views by the EscapedErrors no-argument field error accessors (medium severity, CVE-2026-59281).
  • Attacker-controlled exponents can no longer drive OperatorPower to create unbounded BigDecimal or BigInteger results and exhaust CPU or heap (medium severity, CVE-2026-47886).
    • A BigDecimal or BigInteger power operation in a SpEL expression whose estimated result exceeds 1,000,000 bits — roughly a 300,000-digit decimal number — now throws a SpelEvaluationException instead of computing the result. Applications that legitimately perform large power arithmetic can raise or remove this limit by setting the spring.expression.maxBigPowerBits JVM system property (or the equivalent Spring property), or by passing a custom maximumBigPowerBits value to the SpelParserConfiguration constructor — use Integer.MAX_VALUE for no limit.
  • Globally enabled SpEL compilation no longer bypasses the restrictions SimpleEvaluationContext enforces during interpreted evaluation (medium severity, CVE-2026-59283).
    • SpEL expression compilation is now disabled by default for SimpleEvaluationContext. Applications that relied on spring.expression.compiler.mode or SpelParserConfiguration to compile expressions evaluated in a SimpleEvaluationContext will now fall back to interpreted evaluation, and can opt back in with the new SimpleEvaluationContext.Builder.withCompilationSupported() method. An already-compiled expression is ignored — not cleared — when evaluated through a context that does not support compilation.
    • This line also gains a new public interface, org.springframework.expression.CompilationAwareEvaluationContext, which an EvaluationContext implementation may implement to declare whether expressions evaluated within it may be compiled. Upstream expresses this as a default method on EvaluationContext itself, which is not possible on this line because its sources compile at Java 6 source level. Existing EvaluationContext implementations are unaffected and continue to support compilation.
  • Template names containing backslashes can no longer escape the configured template directory through SpringTemplateLoader.findTemplateSource() (medium severity, CVE-2026-59280).
  • A request-derived view name that still begins with redirect: or forward: once the configured prefix and suffix are applied is now rejected with a 400 Bad Request by UrlFilenameViewController instead of triggering navigation (medium severity, CVE-2026-47887).
  • An untrusted view URL can no longer select an arbitrary stylesheet resource location through XsltView.getStylesheetSource() (critical severity, CVE-2026-47884).

June 2026

4.3.39

Released Jun 10, 2026
CVE-2026-41841
CVE-2026-41842
CVE-2026-41843
CVE-2026-41844
CVE-2026-41845
7 More
Full Version: 
4.3.30-spring-framework-4.3.39

Security Fixes

  • Cache collisions in CachingResourceResolver could expose protected static resources (CVE-2026-41841).
  • Denial of service via slow versioned static resource resolution (CVE-2026-41842).
  • Path traversal in versioned static resource resolution (CVE-2026-41843).
  • Open redirect via redirect: and forward: prefixes in default view name translation (CVE-2026-41844).
  • Incorrect escaping in JavaScriptUtils#javaScriptEscape enabling cross-site scripting (CVE-2026-41845).
  • Cross-site scripting via unescaped cssClass, cssErrorClass, and cssStyle attributes in JSP form tags (CVE-2026-41846).
  • Regular expression denial of service (ReDoS) in AntPathMatcher (CVE-2026-41848).
  • Integer overflow in Spring Expression Language (SpEL) evaluation enabling denial of service (CVE-2026-41849).
  • Algorithmic denial of service in SpEL; adds a configurable maximum-operations limit (CVE-2026-41850).
  • Unbounded SpEL pattern cache growth leading to memory exhaustion (CVE-2026-41851).
  • SpEL permitted zero-argument method invocation in restricted evaluation contexts (CVE-2026-41852).
  • Arbitrary class instantiation in the JMS MappingJackson2MessageConverter; adds a trusted-packages API to restrict deserialization (CVE-2026-41855).

April 2026

4.3.38

Released Apr 17, 2026
CVE-2026-22741
CVE-2026-22745
Full Version: 
4.3.30-spring-framework-4.3.38

Security Fixes

  • Static resource cache poisoning in Spring MVC (CVE-2026-22741)
  • Denial of service in static resource handling on Windows platforms (CVE-2026-22745)

March 2026

4.3.37

Released Mar 23, 2026
CVE-2026-22735
CVE-2026-22737
Full Version: 
4.3.30-spring-framework-4.3.37

Security Fixes

  • SSE content spoofing via unvalidated id and event field values in SseEmitter (CVE-2026-22735).
  • Path traversal via unvalidated template location in ScriptTemplateView (CVE-2026-22737).

October 2025

4.3.36

Released Oct 21, 2025
CVE-2025-41254
Full Version: 
4.3.30-spring-framework-4.3.36

Security Fixes

  • This patches the Spring Framework STOMP over websocket CSRF vulnerability (CVE-2025-41254).

August 2025

4.3.35

Released Aug 15, 2025
CVE-2025-41242
Full Version: 
4.3.30-spring-framework-4.3.35

Security Fixes

  • Fixed a "Path Traversal Vulnerability" occurring in Spring web MVC applications deployed to a Servlet container that is not secured.

May 2025

4.3.34

Released May 15, 2025
CVE-2025-22233
Full Version: 
4.3.30-spring-framework-4.3.34

Security Fixes

  • Fixed an additional vulnerability with DataBinder's disallowedFields related to case insensitivity.

February 2025

4.3.33

Released Feb 24, 2025
Full Version: 
4.3.30-spring-framework-4.3.33

Notes

  • Publish Spring Framework under the org.springframework group ID instead of com.herodevs.nes.springframework

December 2024

4.3.32

Released Dec 18, 2024
CVE-2022-22950
CVE-2022-22965
CVE-2022-22970
CVE-2022-22971
CVE-2023-20861
10 More
Full Version: 
4.3.30-spring-framework-4.3.32

Security Fixes

  • This release patches the following:
    • Spring Expression DoS Vulnerability (CVE-2022-22950).
      • com.herodevs.nes.springframework:spring-expression:4.3.30-spring-framework-4.3.32
    • Spring Framework RCE via Data Binding on JDK 9+ (CVE-2022-22965).
      • com.herodevs.nes.springframework:spring-beans:4.3.30-spring-framework-4.3.32
      • com.herodevs.nes.springframework:spring-webmvc:4.3.30-spring-framework-4.3.32
    • Spring Framework DoS via Data Binding to MultipartFile or Servlet Part (CVE-2022-22970).
      • com.herodevs.nes.springframework:spring-beans:4.3.30-spring-framework-4.3.32
    • Spring Framework DoS with STOMP over WebSocket (CVE-2022-22971).
      • com.herodevs.nes.springframework:spring-messaging:4.3.30-spring-framework-4.3.32
    • Spring Expression DoS Vulnerability (CVE-2023-20861).
      • com.herodevs.nes.springframework:spring-expression:4.3.30-spring-framework-4.3.32
    • Spring Expression DoS Vulnerability (CVE-2023-20863).
      • com.herodevs.nes.springframework:spring-expression:4.3.30-spring-framework-4.3.32
    • Spring Framework URL Parsing with Host Validation (CVE-2024-22243).
      • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
    • Spring Framework URL Parsing with Host Validation (CVE-2024-22259).
      • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
    • Spring Framework URL Parsing with Host Validation (CVE-2024-22262).
      • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
    • Improper handling of case sensitivity (CVE-2022-22968).
      • com.herodevs.nes.springframework:spring-context:4.3.30-spring-framework-4.3.32
      • com.herodevs.nes.springframework:spring-webmvc:4.3.30-spring-framework-4.3.32
    • Spring Expression DoS Vulnerability (CVE-2024-38808).
      • com.herodevs.nes.springframework:spring-expression:4.3.30-spring-framework-4.3.32
    • Spring Framework DoS via conditional HTTP request (CVE-2024-38809).
      • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
    • Spring Framework DataBinder Case Sensitive Match Exception (CVE-2024-38820).
      • com.herodevs.nes.springframework:spring-context:4.3.30-spring-framework-4.3.32
    • DoS via Spring MVC controller method with byte parameter (CVE-2024-38828).
      • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
    • Pivotal Spring Framework contains unsafe Java deserialization methods (CVE-2016-1000027).
      • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32

November 2024

4.3.31

Released Nov 18, 2024
Full Version: 
4.3.30-spring-framework-4.3.31

Notes

  • This is the initial release of Spring Framework 4.3.30 from the open‑source Spring Framework repository forked by HeroDevs.
  • This release contains no functional changes from Spring Framework 4.3.30. Full Version: 4.3.30-spring-framework-4.3.31

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.