Use the Spring security advisories page: it lists each advisory with severity, CVE ID, project, publication date and fix versions, and it offers an RSS feed. Filter by the Spring projects in your build, then compare the fix versions with what your dependency tree resolves.
What the page shows
The page at spring.io lists advisories in a table with these columns: severity (Critical, High, Medium or Low), CVE ID, project, published date, and the number of fix versions. You can filter by project and by generation, and an RSS feed link sits at the top. The page also points to a security policy for reporting a vulnerability.
The project list is long. It includes Spring Framework, Spring Boot, Spring Security, Spring Data modules, Spring Cloud modules, Spring AI, Reactor Netty and others. That breadth is the first lesson: the name "Spring" covers dozens of separately versioned libraries.
Why one date can carry many advisories
When you scroll the list, you will see many entries with the same publication date across different projects. A coordinated release can fix several issues at once. Do not assume that one fix covers everything, because each project has its own versions.
Step by step
- List the Spring projects you actually use. In Maven, run the dependency tree. In Gradle, use the dependencies task. Transitive Spring modules count.
- In the advisories page, filter by each project and read the newest entries.
- For each entry, open it and read the affected versions and the fix versions for your generation.
- Compare with the resolved version in your build, not the version you declared. A bill of materials or a parent can override your choice.
- Upgrade to a fix version on your generation. If none exists for your generation, plan a move to a supported one.
- Re-run the build and tests, then deploy.
Common traps
| Trap | What to do |
|---|---|
| You declare Spring Boot but the advisory names a library it manages | Check the managed version in the resolved tree |
| An older generation has no fix | Plan an upgrade to a supported generation |
| The advisory names a feature you do not use | Record that, but still schedule the upgrade |
| Several advisories land the same day | Upgrade once to the highest fix version |
Try it yourself
Click through it at your own pace, or open it full screen. Watch how checking whether code is called changes which advisories you handle first.
Where Safeguard fits
Safeguard's SBOM and dependency scanning resolves the Spring modules you ship, and reachability analysis helps show whether vulnerable code is called. You can run a free scan at https://gold.safeguard.sh/scan.
For a routine around many feeds, see who reads the advisory feeds.
Quick check
Is there a feed for Spring advisories?
Yes. The Spring advisories page links an RSS feed at the top.
Do I need to patch if I only use Spring Boot?
Spring Boot pulls in other Spring projects. Check the resolved dependency tree to see which ones you ship.
Sources
- Spring Security Advisories, fetched 19 October 2026.
Last reviewed: 19 October 2026.
