Spring Boot Release Cycle and CVE Resolution for Apache Tomcat Dependencies
Article ID: 447011
Updated On:
Products
Issue/Introduction
Security scanners (e.g., Black Duck) may identify vulnerabilities in the Apache Tomcat dependency used by Spring Boot applications. Specifically, CVE-2026-50229 and CVE-2026-53434 may be flagged as High severity by internal scanning tools, despite being classified as Low severity by Apache and the Spring Engineering team.
Environment
Product: VMware Tanzu Spring Runtime / Spring Boot
Versions: Spring Boot 3.5.x (and other versions past OSS support)
Dependency: Apache Tomcat 10.1.55 or earlier
Cause
The vulnerabilities are present in older versions of Apache Tomcat. While fixed in Tomcat 10.1.56, Spring Boot releases follow a specific monthly release cycle. Additionally, certain minor versions of Spring Boot may have reached the end of their Open Source Software (OSS) support window, meaning new updates are only available through commercial channels.
Resolution
Users must upgrade to a version of Spring Boot that includes the patched Tomcat dependency.
1. Monitor Release Schedule: Official release dates for Spring Boot are maintained at calendar.spring.io. The next round of releases, including the Tomcat 10.1.56 upgrade, is typically available by the end of each calendar month.
2. Access Commercial Patches: If the version in use (e.g., Spring Boot 3.5.x) is no longer under OSS support, security fixes and dependency upgrades are provided exclusively via the Spring Enterprise Subscription.
3. Manual Dependency Override (Workaround): If your security policy requires immediate remediation before the next official Spring Boot release, you can manually override the Tomcat version in your project's build configuration:
* Maven: Set the tomcat.version property in your pom.xml.
<properties>
<tomcat.version>10.1.56</tomcat.version>
</properties>
* Gradle: Update the version in your build.gradle using the dependency management plugin or by specifying the direct coordinate.
4. Out-of-band Releases: Spring Boot 3.5.16 was released on June 25. It was an out-of-band release due to a regression introduced in 3.5.15. There is an automated process in place to upgrade, but that did not happen for this specific release since it was out-of-band (not in line with normal release cadence).
Additional Information
Feedback
