HeroDevs
Visit NES for Spring Home Page

Spring Integration 6.3.x Release Notes

4 versions

Comprehensive release notes and changelog for Spring Integration 6.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Jun 15, 2026
Latest: 6.3.15
7 Patched Vulnerabilities
VEX Statements

June 2026

6.3.15

Released Jun 15, 2026
CVE-2026-40987
Full Version: 
6.3.11-spring-integration-6.3.15

Bug Fixes

  • Addressed a path-traversal vulnerability in the remote-file inbound synchronizer, where a malicious or compromised FTP/SFTP/SMB server could write attacker-controlled files outside the configured local directory; path validation is now centralized in FileUtils.newFileInDirectoryIfValid, which rejects .. segments and escaping absolute paths (CVE-2026-40987).

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.19
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.17
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.28
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.14
  • Spring Security (NES) 6.3.10-spring-security-6.3.14

April 2026

6.3.14

Released Apr 28, 2026
Full Version: 
6.3.11-spring-integration-6.3.14

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.18
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.16
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.27
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.13
  • Spring Security (NES) 6.3.10-spring-security-6.3.13

March 2026

6.3.13

Released Mar 25, 2026
Full Version: 
6.3.11-spring-integration-6.3.13

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.17
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.15
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.26
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.12
  • Spring Security (NES) 6.3.10-spring-security-6.3.12

December 2025

6.3.12

Released Dec 10, 2025
CVE-2025-41254
Full Version: 
6.3.11-spring-integration-6.3.12

Notes

  • This release originates from the open‑source Spring Integration repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.
  • The recent CVE-2025-41254 patch for Spring Framework (NES) 6.1.25 required an update to Spring Integration's websocket integration. This change updates the websocket integration with Spring Framework to register a client session with a STOMP CONNECT frame. See the following related GitHub issue for additional details.

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.16
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.14
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.25
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.11
  • Spring Security (NES) 6.3.10-spring-security-6.3.11Full Version: 6.3.11-spring-integration-6.3.12

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.