Spring
Follow
Spring Framework 6.2.10 release fixes CVE-2025-41242
Spring Framework 6.2.10 has been released, offering eleven fixes and documentation enhancements. This update will also be included in upcoming Spring Boot versions 3.4.9 and 3.5.5. A significant fix in this release addresses CVE-2025-41242, a path traversal vulnerability affecting non-compliant Servlet containers. Open-source support for Spring Framework generations 5.3.x and 6.1.x has concluded. Consequently, the fix for CVE-2025-41242 is available in the commercial releases 5.3.44 and 6.1.22. Users not utilizing commercial support are strongly encouraged to upgrade to an actively supported open-source version. Commercial customers employing Spring Boot versions 2.7, 3.1, or 3.2 can now access specific hotfix releases. These hotfixes, including 2.7.28.1, 3.2.17.1, and 3.3.14.1, are accessible through the Spring commercial artifact repository. Access to these commercial releases requires a Spring Enterprise Subscription. Users are advised to upgrade to ensure they are on supported and secure versions.