--- title: Spring milestone wave fixes 91 CVEs, JDK 27 locks its RC description: Spring shipped a synchronized wave of milestone releases across ten projects, bundling new features with fixes for over 91 CVEs, including a deserialization... canonical: https://daily.dev/posts/spring-milestone-wave-fixes-91-cves-jdk-27-locks-its-rc-vfoknstdo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Spring milestone wave fixes 91 CVEs, JDK 27 locks its RC | daily.dev og:description: Spring shipped a synchronized wave of milestone releases across ten projects, bundling new features with fixes for over 91 CVEs, including a deserialization... og:url: https://daily.dev/posts/spring-milestone-wave-fixes-91-cves-jdk-27-locks-its-rc-vfoknstdo og:image: https://api.daily.dev/og/posts/VfOKNSTdo.png og:image:alt: Spring milestone wave fixes 91 CVEs, JDK 27 locks its RC og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Spring milestone wave fixes 91 CVEs, JDK 27 locks its RC **[Java Digest](https://daily.dev/sources/java_digest)** · 4 min read · 1 upvotes · 0 comments ## Summary Spring shipped a synchronized wave of milestone releases across ten projects, bundling new features with fixes for over 91 CVEs, including a deserialization RCE in Spring Integration. JDK 27 is now feature-complete ahead of its September 15 GA, bringing compact object headers, G1 everywhere, and post-quantum TLS by default. Quarkus 3.39 adds its own post-quantum TLS support, and a Spring Boot banking writeup lays out concrete PQC patterns you can actually ship. Elsewhere, a WebAssembly experiment quantifies exactly what Spring Boot costs you in a browser-tab deployment. ## Content **TLDR:** Spring shipped a synchronized wave of milestone releases across ten projects, bundling new features with fixes for over 91 CVEs, including a deserialization RCE in Spring Integration. JDK 27 is now feature-complete ahead of its September 15 GA, bringing compact object headers, G1 everywhere, and post-quantum TLS by default. Quarkus 3.39 adds its own post-quantum TLS support, and a Spring Boot banking writeup lays out concrete PQC patterns you can actually ship. Elsewhere, a WebAssembly experiment quantifies exactly what Spring Boot costs you in a browser-tab deployment. --- ## Spring ecosystem ships ten milestone releases together, patches 91 CVEs After a ten-week gap, Spring Boot 4.2.0-M1, Spring Framework 7.1.0-M1, Spring Security 7.2.0-M1, Spring Data, Batch, Integration, AMQP, Kafka, HATEOAS, and Modulith all landed at once. The security patches are the real story: CVE-2026-59307 is a Java deserialization RCE in Spring Integration, CVE-2026-59271 leaks RabbitMQ admin passwords in exception messages, and CVE-2026-47860 is a DoS via oversized compressed AMQP messages. Sonatype says the patches touch roughly 209,569 software components, and Broadcom's advisory volume reportedly jumped over 1,700% between March and April - their CTO blames AI shrinking the gap between vulnerability discovery and exploitation on both sides. [Read more](https://daily.dev/posts/NZxQdfd5G) ## JDK 27 hits release candidate, ships September 15 Nine JEPs are locked in. Compact Object Headers merge the mark word and class pointer into one 64-bit word, shrinking a two-int object from 24 to 16 bytes and saving roughly 10-20% of heap on typical workloads with zero code changes. G1 is now the default GC everywhere - small containers used to silently fall back to Serial GC, and that fallback is gone. TLS 1.3 also gets X25519MLKEM768 hybrid key exchange on by default, so post-quantum resistance ships without you asking for it. JDK 28 (March 2027) is shaping up with a Simple JSON API incubator and the first Value Objects preview from Valhalla. [Read more](https://daily.dev/posts/TqSlxHIOs) ## Post-quantum crypto moves from JEP to production pattern JDK 24 already added native ML-KEM/ML-DSA support via JEP 496/497, and this week two frameworks caught up on the application side. Quarkus 3.39 wires PQC into its TLS registry across the HTTP server, client, and mailer with configurable key-exchange groups and enforcement policy. Separately, a Spring Boot banking writeup lays out four shippable patterns - Kyber+AES-256-GCM for inter-service payloads, Dilithium for document signing, field-level PII encryption - while warning that Harvest Now, Decrypt Later attacks against RSA traffic are already happening, and that OAuth2 token signing should wait since Spring Security's Dilithium support is still incomplete. [Read more](https://daily.dev/feed-by-ids?id=Pb1KsOfN8&id=cFrRB1Unn) ## Spring Boot in a browser tab, and what the framework actually costs A developer AOT-compiled a full Spring Boot 4.1.1 and Spring Modulith app to WebAssembly using GraalVM Web Image and ran it in a browser tab with no backend or JVM. Stripping Spring Boot out for comparison showed the framework accounts for about 92% of the Wasm module - 16.1 MB versus 1.3 MB, with a 13x smaller gzip payload and 7x faster startup without it. It's not an anti-framework take, more a concrete number for what you're paying when you ship a full-stack framework over the network instead of running it server-side. [Read more](https://daily.dev/posts/AYa8XfGt9) --- ## Also notable - **IntelliJ's real language engine now runs inside VS Code:** JetBrains' preview extension brings the actual IntelliJ Java/Kotlin engine into VS Code and Cursor via LSP, but conflicts with Red Hat, Oracle, and Microsoft's Java extensions and requires disabling them per workspace. [Read more](https://daily.dev/posts/nesNM4gM1) - **Kafka rebalancing fixed by swapping JPA saves for JdbcTemplate.batchUpdate():** A production incident traced recurring 10-minute consumer rebalances to a handler saving ~46,000 rows via JPA exceeding max.poll.interval.ms, resolved by switching that save path to batch JDBC. [Read more](https://daily.dev/posts/LEJMN2ka2) - **DuckDB's JDBC driver now runs natively in GraalVM Native Image:** A JDK 22+ change to run class initializers at runtime instead of build time fixed the long-standing UnsatisfiedLinkError, with a benchmark showing 0.95s native startup versus 1.36s on the JVM. [Read more](https://daily.dev/posts/ffLdgf4ny) - **Bug report to Microsoft fix in weeks for a reactor-netty ByteBuf leak:** Bisecting reactor-netty-http versions isolated a memory leak regression between 1.1.23 (clean) and 1.1.24 (leaking), affecting the Azure OpenAI SDK for Java, and Microsoft's Azure SDK team shipped a fix within weeks of the report. [Read more](https://daily.dev/posts/aJtiPD6Xy) - **Four critical Tomcat CVEs and an asyncssh path-traversal flaw patched:** This week's security roundup covers Tomcat authorization CVEs fixed in 11.0.25/10.1.58/9.0.121 and an asyncssh SCP path-traversal bug (CVE-2026-54591) fixed in 2.23.1. [Read more](https://daily.dev/posts/f051TD3Rj) --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#quantum-computing](https://daily.dev/tags/quantum-computing), [#spring-boot](https://daily.dev/tags/spring-boot), [#jdk](https://daily.dev/tags/jdk) [View this post on daily.dev](https://daily.dev/posts/spring-milestone-wave-fixes-91-cves-jdk-27-locks-its-rc-vfoknstdo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/spring-milestone-wave-fixes-91-cves-jdk-27-locks-its-rc-vfoknstdo","headline":"Spring milestone wave fixes 91 CVEs, JDK 27 locks its RC","text":"Spring shipped a synchronized wave of milestone releases across ten projects, bundling new features with fixes for over 91 CVEs, including a deserialization RCE in Spring Integration. JDK 27 is now feature-complete ahead of its September 15 GA, bringing compact object headers, G1 everywhere, and post-quantum TLS by default. Quarkus 3.39 adds its own post-quantum TLS support, and a Spring Boot banking writeup lays out concrete PQC patterns you can actually ship. Elsewhere, a WebAssembly experiment quantifies exactly what Spring Boot costs you in a browser-tab deployment.","url":"https://daily.dev/posts/spring-milestone-wave-fixes-91-cves-jdk-27-locks-its-rc-vfoknstdo","datePublished":"2026-08-31T04:19:33.794Z","dateModified":"2026-08-31T04:19:57.213Z","author":{"@type":"Organization","name":"Java Digest","logo":"https://media.daily.dev/image/upload/s---g5D7hJ2--/f_auto,q_auto/v1773839415/logos/java_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/java_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/java_digest","name":"Java Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Java Digest","item":"https://daily.dev/sources/java_digest"},{"@type":"ListItem","position":3,"name":"Spring milestone wave fixes 91 CVEs, JDK 27 locks its RC"}]} ```