--- title: Spring ecosystem milestone releases bring new features... description: A batch of Spring ecosystem milestone releases shipped together after a ten-week gap, including Spring Boot 4.2.0-M1, Spring Framework 7.1.0-M1, Spring Data... canonical: https://daily.dev/posts/spring-ecosystem-milestone-releases-bring-new-features-and-91-cve-fixes-nzxqdfd5g twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Spring ecosystem milestone releases bring new features and 91 CVE fixes | daily.dev og:description: A batch of Spring ecosystem milestone releases shipped together after a ten-week gap, including Spring Boot 4.2.0-M1, Spring Framework 7.1.0-M1, Spring Data... og:url: https://daily.dev/posts/spring-ecosystem-milestone-releases-bring-new-features-and-91-cve-fixes-nzxqdfd5g og:image: https://api.daily.dev/og/posts/NZxQdfd5G.png og:image:alt: Spring ecosystem milestone releases bring new features and 91 CVE fixes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Spring ecosystem milestone releases bring new features and 91 CVE fixes **[Collections](https://daily.dev/sources/collections)** · 2 min read · 3 upvotes · 0 comments ## Summary A batch of Spring ecosystem milestone releases shipped together after a ten-week gap, including Spring Boot 4.2.0-M1, Spring Framework 7.1.0-M1, Spring Data 2026.1.0-M1, Spring Security 7.2.0-M1, and several others, bringing new features like AMQP 1.0 support and RedisJsonTemplate. More significant is a batch of 91 CVE fixes across the ecosystem, including a Java deserialization RCE in Spring Integration and a RabbitMQ password-leak bug. Sonatype notes the patches affect over 209,000 software components and that Broadcom's advisory volume jumped over 1,700% between March and April, attributed partly to AI accelerating both vulnerability discovery and exploitation. ## Content ## What shipped After a ten-week gap, a wave of Spring milestone releases landed at once: Spring Boot 4.2.0-M1, Spring Framework 7.1.0-M1, Spring Data 2026.1.0-M1, Spring Security 7.2.0-M1, Spring Integration 7.2.0-M1, Spring HATEOAS 3.2.0-M1, Spring Modulith 2.2.0-M1, Spring Batch 6.1.0-M1, Spring AMQP 4.2.0-M1, and Spring for Apache Kafka 4.2.0-M1. Maintenance releases for Spring Modulith (2.1.1, 2.0.8, 1.4.13) also came out alongside the milestone. ## Notable changes A few things stand out across the releases: - **Spring Boot 4.2.0-M1** adds AMQP 1.0 support via RabbitMQ and switches to Jetty's GracefulHandler for shutdown. - **Spring Framework 7.1.0-M1** introduces a new `forParameter()` factory method. - **Spring Data 2026.1.0-M1** includes initial `RedisJsonTemplate` support. ## Security fixes This is the part worth paying attention to. Over 91 CVEs were patched across the ecosystem. The ones with real teeth: - **CVE-2026-59307** - A Java deserialization RCE in Spring Integration. - **CVE-2026-59321** - A message-corruption bug in scripting engines. - **CVE-2026-47860** - A denial-of-service in Spring AMQP via oversized compressed messages. - **CVE-2026-59271** - RabbitMQ admin passwords leaking in exception messages. Sonatype flagged that these patches affect roughly 209,569 software components. Broadcom's advisory volume reportedly jumped over 1,700% between March and April, which Sonatype CTO Brian Fox attributes to AI giving both defenders and attackers faster ways to find vulnerabilities - essentially compressing the window between discovery and exploitation. The practical advice from Sonatype: automate patch deployment, look into virtual patching, and audit your open source dependencies. Many volunteer-maintained projects simply can't keep up with rapid patch cycles, so rationalization matters. ## Where to follow along Josh Long's "This Week in Spring" roundup covers these releases alongside a RabbitMQ vs. Kafka comparison and other community content. He'll be at JavaZone, IntelliJ IDEA Conf, and KCDC if you want to catch him in person. ## Questions this post answers ### What CVEs were fixed in the latest Spring Integration and Spring AMQP releases? Spring Integration's milestone patched CVE-2026-59307, a Java deserialization remote code execution vulnerability, while Spring AMQP fixed CVE-2026-47860, a denial-of-service issue triggered by oversized compressed messages. Additionally, CVE-2026-59321 addressed a message-corruption bug in scripting engines and CVE-2026-59271 fixed RabbitMQ admin passwords leaking in exception messages. Over 91 CVEs were patched across the whole Spring ecosystem in this release wave. _Teams tracking Spring CVEs across dozens of modules can follow the fixes as they land on daily.dev._ ### How many software components are affected by the recent Spring/Broadcom security patches? Sonatype estimates roughly 209,569 software components are affected by the patches issued across the Spring ecosystem in this release wave. Sonatype's CTO Brian Fox also noted that Broadcom's advisory volume jumped over 1,700% between March and April, a spike attributed partly to AI speeding up vulnerability discovery for both defenders and attackers. _daily.dev helps developers auditing dependency risk keep pace with sudden spikes in advisory volume._ ### What new feature did Spring Boot 4.2.0-M1 add for messaging? Spring Boot 4.2.0-M1 added AMQP 1.0 support via RabbitMQ, alongside a switch to Jetty's GracefulHandler for shutdown handling. This milestone shipped as part of a broader wave of Spring ecosystem releases including Spring Framework 7.1.0-M1 and Spring Data 2026.1.0-M1, which introduced initial RedisJsonTemplate support. _Developers evaluating messaging upgrades in Spring Boot can track milestone changes like this on daily.dev._ ## Similar posts on daily.dev - [Spring News Roundup: Third Milestone Releases of Boot, Security, Integration, AI and AMQP](https://daily.dev/posts/spring-news-roundup-third-milestone-releases-of-boot-security-integration-ai-and-amqp-q85vfl82s) · InfoQ · 0 upvotes · 0 comments - [Java Weekly, Issue 622](https://daily.dev/posts/java-weekly-issue-622-yhsvtmyww) · Baeldung · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#spring-boot](https://daily.dev/tags/spring-boot), [#spring-security](https://daily.dev/tags/spring-security) [View this post on daily.dev](https://daily.dev/posts/spring-ecosystem-milestone-releases-bring-new-features-and-91-cve-fixes-nzxqdfd5g) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Spring ecosystem milestone releases bring new features and 91 CVE fixes","url":"https://daily.dev/posts/spring-ecosystem-milestone-releases-bring-new-features-and-91-cve-fixes-nzxqdfd5g","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/spring-ecosystem-milestone-releases-bring-new-features-and-91-cve-fixes-nzxqdfd5g"},"datePublished":"2026-08-27T17:40:39.319Z","dateModified":"2026-09-13T20:03:41.789Z","description":"A batch of Spring ecosystem milestone releases shipped together after a ten-week gap, including Spring Boot 4.2.0-M1, Spring Framework 7.1.0-M1, Spring Data...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b950c61d7da720a20cec0283c056ec38?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b950c61d7da720a20cec0283c056ec38?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/spring-ecosystem-milestone-releases-bring-new-features-and-91-cve-fixes-nzxqdfd5g","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java,spring-boot,spring-security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Spring ecosystem milestone releases bring new features and 91 CVE fixes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/spring-ecosystem-milestone-releases-bring-new-features-and-91-cve-fixes-nzxqdfd5g#faq","mainEntity":[{"@type":"Question","name":"What CVEs were fixed in the latest Spring Integration and Spring AMQP releases?","acceptedAnswer":{"@type":"Answer","text":"Spring Integration's milestone patched CVE-2026-59307, a Java deserialization remote code execution vulnerability, while Spring AMQP fixed CVE-2026-47860, a denial-of-service issue triggered by oversized compressed messages. Additionally, CVE-2026-59321 addressed a message-corruption bug in scripting engines and CVE-2026-59271 fixed RabbitMQ admin passwords leaking in exception messages. Over 91 CVEs were patched across the whole Spring ecosystem in this release wave. Teams tracking Spring CVEs across dozens of modules can follow the fixes as they land on daily.dev."}},{"@type":"Question","name":"How many software components are affected by the recent Spring/Broadcom security patches?","acceptedAnswer":{"@type":"Answer","text":"Sonatype estimates roughly 209,569 software components are affected by the patches issued across the Spring ecosystem in this release wave. Sonatype's CTO Brian Fox also noted that Broadcom's advisory volume jumped over 1,700% between March and April, a spike attributed partly to AI speeding up vulnerability discovery for both defenders and attackers. daily.dev helps developers auditing dependency risk keep pace with sudden spikes in advisory volume."}},{"@type":"Question","name":"What new feature did Spring Boot 4.2.0-M1 add for messaging?","acceptedAnswer":{"@type":"Answer","text":"Spring Boot 4.2.0-M1 added AMQP 1.0 support via RabbitMQ, alongside a switch to Jetty's GracefulHandler for shutdown handling. This milestone shipped as part of a broader wave of Spring ecosystem releases including Spring Framework 7.1.0-M1 and Spring Data 2026.1.0-M1, which introduced initial RedisJsonTemplate support. Developers evaluating messaging upgrades in Spring Boot can track milestone changes like this on daily.dev."}}]} ```