What were the notable Spring updates?

Fix default BSP enforcement for Wss4jSecurityInterceptor, Enforce UserDetails account state for X.509 authentication, and Reject RSA PKCS#1 v1.5 key transport for inbound WS-Security by default.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

SPRING WS CLOSES THREE AUTHENTICATION SECURITY GAPS OVERNIGHT

By RepoJournal · Filed 06:04 UTC on June 10, 2026 · About Spring

Spring Web Services shipped fixes for BSP enforcement, X.509 account validation, and RSA key transport defaults that were silently weakening cryptographic defenses across the stack.

Three separate authentication and encryption hardening changes landed in spring-ws that each contradict documented secure defaults. The bspCompliant flag defaulted to false despite Javadoc claiming true, disabling WSS4J's Basic Security Profile checks and opening the door to non-standard transforms and signature abuse [1]. X509AuthenticationProvider was issuing authenticated tokens without applying Spring Security's account lifecycle checks, allowing disabled, locked, or expired accounts to authenticate [2]. A third fix flips RSA PKCS#1 v1.5 key transport from enabled to disabled by default [3], aligning with WSS4J's safer posture. Meanwhile, spring-ws also hardened authentication failure messages to block account-status information leaks [4] and introduced stricter validation for WS-Addressing out-of-band reply destinations using a new UriSource classification system [5]. On the release front, Spring Security 7.1.0 shipped [12] alongside point releases for 7.0.6 [13] and 6.5.11 [14], with Spring Boot and Spring WebFlow pulling in these security updates [ref:6, ref:7, ref:8, ref:11]. Spring WebFlow v3.0.2 and v4.0.1 are out with improved Ajax error handling and default mapping expression parsing [ref:12, ref:13].

Action items

→ Upgrade spring-ws and audit X.509 authentication configurations immediately spring-projects/spring-ws [immediate]
→ Pull Spring Security 7.1.0, 7.0.6, or 6.5.11 depending on your line - verify opaque token introspector configs spring-projects/spring-security [immediate]
→ Review any WS-Addressing reply destinations currently allowing remote URIs without validation spring-projects/spring-ws [plan]
→ Update Spring WebFlow to v3.0.2 or v4.0.1 for Ajax handling and expression parsing fixes spring-projects/spring-webflow [plan]

References

[1] Fix default BSP enforcement for Wss4jSecurityInterceptor spring-projects/spring-ws
[2] Enforce UserDetails account state for X.509 authentication spring-projects/spring-ws
[3] Reject RSA PKCS#1 v1.5 key transport for inbound WS-Security by default spring-projects/spring-ws
[4] Harden auth failures against account-status information leaks spring-projects/spring-ws
[5] Harden WS-Addressing out-of-band reply destinations spring-projects/spring-ws
[6] Upgrade to Spring Security 7.1.0 spring-projects/spring-boot
[7] Upgrade to Spring Security 6.5.11 spring-projects/spring-boot
[8] Upgrade to Spring Security 7.0.6 spring-projects/spring-boot
[9] Upgrade to Spring Security 7.0.6 spring-projects/spring-webflow
[10] v3.0.2 ↗ spring-projects/spring-webflow
[11] v4.0.1 ↗ spring-projects/spring-webflow
[12] 7.1.0 ↗ spring-projects/spring-security
[13] 7.0.6 ↗ spring-projects/spring-security
[14] 6.5.11 ↗ spring-projects/spring-security

Quick answers

What shipped in Spring on June 10, 2026?: Spring Web Services shipped fixes for BSP enforcement, X.509 account validation, and RSA key transport defaults that were silently weakening cryptographic defenses across the stack. In total, 95 commits, 27 pull requests, and 7 releases landed.
What were the notable Spring updates?: Fix default BSP enforcement for Wss4jSecurityInterceptor, Enforce UserDetails account state for X.509 authentication, and Reject RSA PKCS#1 v1.5 key transport for inbound WS-Security by default.

SPRING BOOT KILLS RESTTEMPLATE, SPRING AI GAINS IMAGE GEN

Spring Boot is deprecating RestTemplate across its entire ecosystem, forcing a migration to RestClient as the Framework itself moves on [ref:1].

java 20 shipped 1-min read

@spring-projects 1 day ago

SPRING BOOT DOCUMENTATION CLEANUP CONTINUES WHILE ECOSYSTEM UPGRADES LOGBACK

Spring Boot is methodically fixing its generated documentation examples as the broader ecosystem shifts to Logback 1.6.0, which removed deprecated APIs.

java 35 shipped 1-min read

@spring-projects 2 days ago

SPRING AI HARDENS ERROR HANDLING, REDIS VECTORSTORE SHEDS BANDWIDTH BLOAT

Spring AI is tightening its security posture on two fronts: MCP server transports now strip exception messages from error responses, while RedisVectorStore cuts network waste by 37 KB per embedding lookup.

java 12 shipped 2-min read

@spring-projects 3 days ago

SPRING BOOT TIGHTENS NULLABILITY CHECKS, FRAMEWORK CLEANS HOUSE

Spring Boot merged improvements to Nullaway 0.13.8 that correctly handle Map#remove nullability, while Spring Framework shipped targeted fixes for logging clarity and documentation.

java 17 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.