HeroDevs
Visit NES for Spring Home Page

Spring Security 5.8.x Release Notes

12 versions

Comprehensive release notes and changelog for Spring Security 5.8.x, including security patches, bug fixes, and feature updates across all supported versions.

Mar 23, 2026
Latest: 5.8.26
33 Patched Vulnerabilities
VEX Statements

March 2026

5.8.26

Released Mar 23, 2026
CVE-2026-22732
Full Version: 
5.8.16-spring-security-5.8.26

Bug Fixes

  • Patched the critical Spring Security vulnerability in OnCommittedResponseWrapper where security headers are silently dropped when Content-Length is set via setHeader, setIntHeader, or addIntHeader (CVE-2026-22732).

Dependency Upgrades

  • Spring Framework (NES) 5.3.39-spring-framework-5.3.50

October 2025

5.8.25

Released Oct 23, 2025
Full Version: 
5.8.16-spring-security-5.8.25

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.24
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.49
  • Spring LDAP (NES) 2.4.4-spring-ldap-2.4.10

September 2025

5.8.24

Released Sep 23, 2025
Full Version: 
5.8.16-spring-security-5.8.24

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.23
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.48
  • Spring LDAP (NES) 2.4.4-spring-ldap-2.4.9

August 2025

5.8.23

Released Aug 25, 2025
Full Version: 
5.8.16-spring-security-5.8.23

Dependency Upgrades

  • Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.22
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.47
  • Spring LDAP (NES) 2.4.4-spring-ldap-2.4.8

May 2025

5.8.22

Released May 20, 2025
Full Version: 
5.8.16-spring-security-5.8.22

Dependency Upgrades

  • Spring Framework (NES): 5.3.39-spring-framework-5.3.46
  • Spring Data BOM (NES): 2021.2.18-spring-data-bom-2021.2.21
  • Spring LDAP (NES): 2.4.4-spring-ldap-2.4.7

April 2025

5.8.21

Released Apr 23, 2025
CVE-2025-22228
CVE-2025-22234
Full Version: 
5.8.16-spring-security-5.8.21

Bug Fixes

  • This patches the bug in Spring Security where the maximum password length enforced in the BCryptPasswordEncoder (patch for CVE-2025-22228) breaks timing attack mitigation in the DaoAuthenticationProvider (CVE-2025-22234).
    • org.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.21

March 2025

5.8.20

Released Mar 20, 2025
CVE-2025-22228
Full Version: 
5.8.16-spring-security-5.8.20

Bug Fixes

  • This patches the bug in Spring Security BCryptPasswordEncoder where maximum password length is not enforced (CVE-2025-22228).
    • org.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.20

5.8.19

Released Mar 6, 2025
Full Version: 
5.8.16-spring-security-5.8.19

Notes

  • Spring Security's artifacts include LICENSE and NOTICE files in the META-INF directory.

February 2025

5.8.18

Released Feb 24, 2025
Full Version: 
5.8.16-spring-security-5.8.18

Notes

  • Publish Spring Security under the org.springframework.security group ID instead of com.herodevs.nes.springframework.security

Dependency Upgrades

  • Spring Framework (NES): 5.3.39-spring-framework-5.3.45
  • Spring Data BOM (NES): 2021.2.18-spring-data-bom-2021.2.20
  • Spring LDAP (NES): 2.4.4-spring-ldap-2.4.6

November 2024

5.8.17

Released Nov 19, 2024
CVE-2024-38827
Full Version: 
5.8.16-spring-security-5.8.17

Bug Fixes

  • This patches the Spring Security Authorization Bypass for Case Sensitive Comparisons (CVE-2024-38827).
    • com.herodevs.nes.springframework.security:spring-security-cas:5.8.16-spring-security-5.8.17
    • com.herodevs.nes.springframework.security:spring-security-config:5.8.16-spring-security-5.8.17
    • com.herodevs.nes.springframework.security:spring-security-core:5.8.16-spring-security-5.8.17
    • com.herodevs.nes.springframework.security:spring-security-crypto:5.8.16-spring-security-5.8.17
    • com.herodevs.nes.springframework.security:spring-security-data:5.8.16-spring-security-5.8.17
    • com.herodevs.nes.springframework.security:spring-security-ldap:5.8.16-spring-security-5.8.17
    • com.herodevs.nes.springframework.security:spring-security-oauth2-client:5.8.16-spring-security-5.8.17
    • com.herodevs.nes.springframework.security:spring-security-taglibs:5.8.16-spring-security-5.8.17
    • com.herodevs.nes.springframework.security:spring-security-web:5.8.16-spring-security-5.8.17

October 2024

5.8.16

Released Oct 29, 2024
CVE-2024-38821
Full Version: 
5.8.15-spring-security-5.8.16

Bug Fixes

  • This patches the Authorization Bypass of Static Resources in WebFlux Applications (CVE-2024-38821).
    • com.herodevs.nes.springframework.security:spring-security-web:5.8.15-spring-security-5.8.16

September 2024

5.8.15

Released Sep 20, 2024
Full Version: 
5.8.14-spring-security-5.8.15

Notes

  • This release originates from the open‑source Spring Security repository forked by HeroDevs starting with version 5.8.14.
  • Includes other modifications implemented by HeroDevs to ensure successful library builds. Full Version: 5.8.14-spring-security-5.8.15

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.