⚠️ Attention Required

• Remove APIs marked as deprecated for removal in 7.1 #37455
• Consistently treat 0 as no timeout in WebTestClient #37454
• Consistently treat 0 as no timeout in MockMvc #37453
• Consistently treat 0 as no timeout in RSocketServiceProxyFactory #37451
• Consistently treat 0 as no timeout in HTTP client support #37425
• Update default settings in WebFlux multipart handling to align with Spring Boot and Tomcat #36928
• Apply proxy with system properties to the default client in ReactorClientHttpConnector #36654
• ProblemDetail instance field set from the current URL path, does not respect RFC #35969

⭐ New Features

• Support JsonUnit as an alternative to JSONassert for JSON comparison in test APIs #37490
• Add RetryState-aware overloads for onRetrySuccess and onRetryFailure #37465
• Consistently treat 0 as no timeout in AsyncServerResponse #37452
• Destroy all filters in CompositeFilter despite failures #37445
• Refine DataAccessUtils to improve null-safety #37438
• Omit zero timeout in DefaultRetryPolicy.toString() #37437
• Avoid splitting surrogate pairs in StringUtils.truncate() #37435
• Support positive hexadecimal values in NumberUtils #37434
• Support compilation of String concatenation with non-String operands in SpEL #37433
• Fix nullability in LinkedCaseInsensitiveMap #37432
• Align parsing of jdk.httpclient.allowRestrictedHeaders in JdkClientHttpRequest with the JDK #37422
• Align restricted header handling in reactive JdkClientHttpRequest with non-reactive JdkClientHttpRequest #37417
• Configure problem details rendering through WebMvcConfigurer #37416
• Fix missing IDENTITY_FINISH characteristic in MergedAnnotationCollectors #37415
• Reject @AliasFor value and attribute when both have length #37413
• Give ErrorResponse.Interceptor access to the current request #37410
• Honor Map.equals() and Map.hashCode() contracts in CompositeMap #37401
• Support rendering problem details as views in @ExceptionHandler methods #37400
• Render exceptions not handled by ExceptionHandler methods as problem details #37398
• Further improve AnnotationAttributes.toString() #37396
• Improve primitive array handling in AnnotationAttributes.toString() #37395
• Exclude static methods from override check in AnnotatedMethod #37390
• Include root cause when MySQLMaxValueIncrementer fails to commit #37389
• Record MVC exceptions leading to HTTP 5xx as errors in observalibity stacks #37384
• Revise getBeanNamesForType caching to cover ResolvableType-based lookups as well #37382
• Support for Hibernate 8.0's BeanContainer SPI revision #37381
• Improve pre-bound JDBC Connection exception message #37356
• Reject Kotlin constructor default values in enhanced @Configuration classes #37350
• Rewrite CssLinkResourceTransformer for a single pass memory efficient parsing #37348
• Deprecate multi-batch batchUpdate variant in JdbcTemplate #37345
• Introduce entry-based DSL for JdbcClient batch updates #37341
• Honor Collection.remove() contract in CompositeCollection #37332
• Exclude static methods from override check in AnnotationsScanner #37319
• Support for JPA 4.0 package and module descriptor discovery #37316
• Set first batch arg once while executing batch with generated keys #37308
• Improve JdbcClient to align BatchSpec with StatementSpec #37307
• Include enum array attributes in TypeNotPresentException probing #37153
• Misleading port number defaults when parsing "Forwarded for" and "Forwarded by" header information #37114
• Remove MatchableHandlerMapping #37093
• Optimize get for all values in ServletRequestHeadersAdapter and ServletResponseHeadersAdapter #37080
• RestClient.Builder.configureMessageConverters disables the implicit registration of default converters. #36747
• Avoid update to request "Content-Type" for characterEncoding in ServletServerHttpRequest #36426
• Remove code to set the ServletResponse contentType and characterEncoding properties from the "Content-Type" header #36352

🐞 Bug Fixes

• Avoid int overflow for large Duration timeouts in ClientHttpRequestFactory implementations #37427
• Annotations are inherited from package-private method in superclass in different package #37408
• MVC MultipartParser requires Publisher on the classpath #37353
• Fix container detection in RepeatableContainers.standardRepeatables() #37326

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.18.0-RC1 #37439
• Upgrade to Reactor 2026.0.0-RC1 #37375

❤️ Contributors

Thank you to all the contributors who worked on this release:

@EsmaeilChitgar, @cookie-meringue, @guanchengang, @itsmevichu, @junhyeong9812, @lejuho, @ngocnhan-tran1996, @quaff, @rene-schakmann, and @xoruddl

⭐ New Features

• Align DelegatingMessageSource fallback implementation with AbstractMessageSource #37383
• HttpEntity(T, MultiValueMap) stores an HttpHeaders unchecked, causing IncompatibleClassChangeError inside RestTemplate #37358
• Recognize relocated Mockito MockAccess interface in ProxyProcessorSupport #37342
• Runtime compatibility with JPA 4.0 M7 and corresponding Hibernate 8.0 snapshots #37315
• Avoid Kotlin reflection in MethodParameter for non-suspending functions #37300
• Revise underscore naming fallback in SimplePropertyRowMapper #37297
• Avoid useless queue ops in ConcurrentLruCache.clear() #37292
• PathMatchingResourcePatternResolver misses jars on java.class.path whose path contains % #37280
• Remove redundant whitespace in exception messages #37277
• OpenInView does no longer work with HibernateTransactionManager #37273
• Lazily handle setClientInfo/setNetworkTimeout in LazyConnectionDataSourceProxy #37261
• Avoid redundant filtering in FilteredMap.size() #37256
• Support NaN and inifinite float values in toString() for synthesized annotations #37244
• Use ArrayList instead of LinkedList in CompositeRetryListener #37231
• redirectedUrl() argument in MockMvcResultMatchers should be @Nullable #37230
• Published Gradle module file is missing javadocElements and sourcesElements #37209
• Introduce a builder for SpelParserConfiguration #37187
• Protobuf support classes all implement getMessageBuilder() #37147
• Allow null contextPath in ServerHttpRequest.Builder #37099
• Log broker availability events as String messages #36856

🐞 Bug Fixes

• Avoid unnecessary dependent-bean registration for autowire-by-type #37424
• Handle zero readTimeout in JdkClientHttpConnector #37412
• Race condition in PartGenerator.CreateFileState can lose the completion signal #37409
• Paused executor with late shutdown leaks its worker thread (and the closed context) after close #37406
• Fix hanging retries for Flux-returning methods with caching #37403
• Avoid serving stale values after failed refill in AbstractIdentityColumnMaxValueIncrementer #37402
• Copy cookies in RenderingResponse.from() #37378
• Avoid phantom keys in LinkedCaseInsensitiveMap.computeIfAbsent #37351
• Fix single-value adaptation for primitive array types in TypeMappedAnnotation #37349
• CssLinkResourceTransformer fails for invalid CSS links #37336
• Fix cached ID reuse after commit failure in MySQLMaxValueIncrementer #37322
• Fix connection leak in MySQLMaxValueIncrementer #37321
• @CacheEvict truncates Flux results to the first element #37309
• ConcurrentLruCache.clear() can miss entries added while it's running #37287
• Enforce disk usage limit when spilling part to disk #37285
• Prevent double size decrement in ConcurrentLruCache #37268
• LogAccessor.debug(CharSequence) eagerly renders LogMessage since spring-core 7 switched from spring-jcl to commons-logging #37266
• WebFlux loses empty multipart file when the file part is not last. #37264
• Complete empty Uni instances from the Mutiny reactive adapter #37259
• DefaultAsyncServerResponse.writeAsync() discards previously configured AsyncWebRequest timeout #37257
• Provide missing native image hints for proxied hibernate 8 query types #37251
• Provide missing native image hint for StatelessSession proxy created by SharedEntityManagerCreator. #37249
• Provide missing native image reflection hint for hibernate PersistenceUnitInfoDescriptor. #37247
• Sort duplicate key codes in SQLErrorCodes #37235
• Handle zero readTimeout in JdkClientHttpRequestFactory #37234
• Wrong reconnection attempt count in ReactorNettyTcpClient #37223
• Stored procedure OUT parameter values are lost outside a transaction as of 7.0.9 #37221
• Avoid int overflow in expiration time calculations in MockMvc and FlashMap #37208
• ScheduledAnnotationBeanPostProcessor doesn't correctly support bean destruction #37207
• Normalize function return parameter lookup in CallMetaDataContext #37206
• Fix out-of-bounds read for truncated percent-escape in opaque host #37203
• ClassFileTransformerAdapter deadlocks between two persistence units under load-time weaving #37199
• Fix Kotlin value class handling for suspending AOP methods #37191
• Update to NullAway 0.14.0 and fix new warnings #37188
• ProtobufJsonEncoder emits JSON array when media type is ndjson #37158
• streamingMediaTypes in ProtobufJsonEncoder not a subset of encodableMimeTypes #37154
• Align DataBufferUtils$WriteCompletionHandler exception handling with the read() side #37145
• DataBufferUtils.read() with NettyDataBuffer on JDK 25 hangs indefinitely #37143
• Release queued body token buffers on multipart cancel #37115
• Preserve async API version resolver order #37096
• ClientResponse.mutate() builder can modify originalResponse headers. #37086
• Custom reason is overwritten by i18n message in ResponseStatusException.updateAndGetBody() #36984
• Generate compilable code for non-finite floating-point values #36965
• Render parameter type names in ClassFileMethodMetadata #36919
• Honor sourceStart offset in AbstractXMLStreamReader#getTextCharacters #36914
• Fix reserveMethodNames to reserve each supplied name #36912
• Replace thread-unsafe SimpleDateFormat with DateTimeFormatter in AbstractMockHttpServletRequestBuilder #36772
• MockHttpServletRequest.isRequestedSessionIdValid() does not follow Servlet 6.1 Javadoc [#36631](https://github.com/spring-projects/spring-framework...

⭐ New Features

• Align DispatcherServlet bean detection logs #37296
• Extract bean property path support into PropertyPath #37275
• Expose matched PathPattern as MVC request attribute #37272
• Add a configurable limit for maximum nesting depth in property paths #37252
• Enforce "data: " (with space) prefix for outgoing SSE data payloads #37242
• Parse RFC 9651-like date headers #37224
• Polish ScheduledAnnotationBeanPostProcessor to refine null-safety #37219
• Add batch update support to JdbcClient #37216
• Emit multipart parts with empty bodies in PartGenerator #37202
• Upgrade to HtmlUnit 5 #37194
• Ignore invalid SSE retry field #37193
• Handle MIME type parameter names case-insensitively #37192
• Deprecate SpelParserConfiguration constructors in favor of the builder API #37190
• When connection to client is lost while writing JSON, it should not be logged as warning #37151
• JMS SimpleMessageConverter.fromMessage() can return null despite @NullMarked package #37148
• Avoid unnecessary allocations for cached annotation mappings #37141
• Update MockCookie#parse(String) validation #37136
• Add WebFlux OpenTelemetry observation convention #37131
• Limit bracket depth in PropertyEditorRegistrySupport's addStrippedPropertyPaths() #37020
• Improve efficiency of map creation in DataBinder #37019
• Reject overlapping declared and generated key columns in SimpleJdbcInsert #37014
• Reject MIME type parameters differing only in case #37008
• Use depth-aware bracket parsing in PropertyAccessorUtils #36999
• Account for all array objects when checking array size in SpEL #36998
• Align SpEL's default max auto-grow size with Spring data binding #36995
• Avoid redundant registration of Date/Calendar/Long converters in DefaultFormattingConversionService #36951
• Suppress CGLIB validation WARN for lifecycle callbacks #36935
• Add Cache-Control must-understand directive #36918
• validate samesite attribute in ResponseCookie #36905
• Close contexts when clearing test context cache #36825
• Use immutable map for static cache in TypeDescriptor #36813
• Add a configurable limit for structural nesting depth in SpEL expressions #36723
• Simplify programmatic scheduling of cron tasks with time zone #36556
• Deprecate Derby support #36045
• Add support for generating resources linked to a feature #35862
• Add RFC 10008 (QUERY HTTP method) support #34993

🐞 Bug Fixes

• PartGenerator.switchToFile() doesn't count buffered bytes toward maxDiskUsagePerPart #37238
• Reject write methods not starting with "set" in Property #37139
• Meta-annotations with attributes are still unnecessarily synthesized in MergedAnnotations #37135
• Use the 4-argument Property constructor in SpEL's ReflectivePropertyAccessor #37123
• Fix BeanFactory.getBean(String, ParameterizedTypeReference) to respect AOP proxy #37047
• Fix OptionalToObjectConverter applicability check #36913
• Fix Property name resolution for record-style accessors #36911

📔 Documentation

• Fix RestClient API usage in documentation #37137
• Add Validation section examples #36190

🔨 Dependency Upgrades

• Upgrade to Kotlin 2.4.20 #37271
• Upgrade to Micrometer 1.18.0-M2 and Tracing 1.8.0-M2 #37288
• Upgrade to Reactor 2026.0.0-M2 #37263

❤️ Contributors

Thank you to all the contributors who worked on this release:

@DevJunz, @Eymenonar, @Sineaggi, @Will-thom, @blackdurumi, @cookie-meringue, @desiderantes, @dxbjavid, @froggy0m0, @gregjotau, @heka1024, @junhyeong9812, @junhyung8795, @kilink, @lArtiquel, @marschall, @mateo-maza, @ngocnhan-tran1996, @noojung, @quaff, @sabberworm, @seonwooj0810, @shaggyinsomniac, @verhasi, and @vpavic

⚠️ Attention Required

• starting in Spring Framework 7.1, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each require a boolean argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property enables use of "X-Forwarded-Prefix" if needed. The default constructor with the existing behaviour of checking both types of headers is still available but deprecated and marked for removal. The new constructor makes forwarded header processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section, as well as related changes in Spring Boot spring-projects/spring-boot#51030. #37072
• Default context config is not detected when superclass or enclosing class is not annotated with @ContextConfiguration #31456

⭐ New Features

• Add logging operators in DefaultExchangeFunction only when debug is enabled #37095
• Consistently enforce non-null instance in AbstractFactoryBean #37091
• Reinstate invalid resource location checks #37063
• Preserve original bean names as aliases with FullyQualifiedConfigurationBeanNameGenerator #37038
• Improve forwarded header parsing #36964
• Avoid "NullAway.Init" suppression in favor of explicit field handling #36961
• Refine and better specify error handling in MultipartParser #36947
• Use double division to calculate applied jitter in ExponentialBackOff #36943
• Throw ClassNotFoundException for missing class resource in ThrowawayClassLoader #36938
• Replace isAssignableFrom() with isInstance() where feasible #36899
• Simplify BUFFER_COUNT in ConcurrentLruCache to a constant #36872
• Apply auto-grow collection limit to direct field binding #36862
• Reject duplicate MIME type parameters #36841
• Add DataSize converters to DefaultConversionService #36830
• Only update ObservationThreadLocalAccessor when a test has an active ApplicationContext #36817
• Deprecate setDisallowedFields in DataBinder for removal #36816
• Optimize ClassNameReader.getClassName via direct ASM API #36814
• AbortedException from client logged at ERROR level with WebFlux functional endpoint #36811
• Add dedicated exception for HttpStatus.PRECONDITION_FAILED #36807
• Reset mocks only when a test has an active ApplicationContext #36782
• Improve MimeType parser for RFC compliance #36729
• Reject unsafe static resource locations in MVC and WebFlux #36695
• Use String#replace instead of String#replaceAll where appropriate #36678
• Beans created with BeanRegistrar on GenericApplicationContext do not honor allow-bean-definition-overriding setting #36648
• Use defensive Date copies for SimpleMailMessage sentDate #36626
• Align StandardMethodMetadata with ASM/ClassFile support for getReturnTypeName() #36619
• Use canonical names in error messages in annotation processing #36607
• Provide bean conditional registration capabilities in BeanRegistrarDsl #36601
• Align with JDK behavior by throwing TypeNotPresentException during annotation processing #36593
• Deprecate RestTemplate and related types #36574
• Remove deprecated methodIdentification() method in CacheAspectSupport #36560
• Reject unbalanced parentheses in profile expressions #36550
• Introduce ResolvableType.forParameter() factory method #36545
• Remove redundant Assert.notNull() checks in ResolvableType #36544
• Introduce support for custom parameter names in ParameterResolutionDelegate #36534
• Perform case-insensitive lookup in HttpMethod.valueOf() #36518
• Add "application/jsonl" support alongside "application/x-ndjson" for streaming #36485
• Replace HandlerMappingIntrospector with PreFlightRequestHandler bean in MVC config #36481
• GenericTypeResolver.resolveType should resolve TypeVariable with nested ParameterizedType #36480
• Introduce classpath*: support for ResourceLoader#getResource with fully specified resource path #36415
• Support for Map body types in FormHttpMessageConverter #36408
• Support compilation of SpEL expressions that use Optional with null-safe and Elvis operators #36330
• Skip Jaxb auto-detection in HttpMessageConverters for servers #36302
• Handle multi-JAR resources in ReloadableResourceBundleMessageSource #36292
• Support for JPA 4.0 @PersistenceAgent injection #36264
• Move multipart support out of FormHttpMessageConverter #36256
• Introduce MultipartHttpMessageConverter #36255
• Introduce HttpMessageConverter#canWriteRepeatedly #36252
• Override Servlet 6.1's doPatch() method in FrameworkServlet #36247
• Allow local @BootstrapWith annotation to override a meta-annotation within the same composed annotation #35938
• Support for JTA 2.1 read-only transaction management #35915
• Add typesafe method to get generic bean by name with type reference #35808
• Support reading multipart requests from RestTestClient in MockMvc #35569
• Use 500 for default exception handling when DisconnectedClientHelper#clientDisconnectedException returns true #34481
• Support reading multipart HTTP messages with a converter #33263
• Provide bean conditional registration capabilities in BeanRegistrar #21497
• Support @MockitoBean and @MockitoSpyBean on test constructor parameters #36096

🐞 Bug Fixes

• Ignore static get/is accessor methods in PropertyDescriptorUtils #37081
• AnnotationDescriptor.findAllLocalMergedAnnotations fails to find interface annotations #36975
• PartGenerator should close the OutputStream when it's done reading the part #36945
• PartGenerator should also cle...

⚠️ Attention Required

• In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
• In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

• Ignore an empty port value in URI parsing #37117
• Avoid retaining class files in annotation metadata #37112
• Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
• Revisit SSE view fragments handling #37061
• Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
• Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
• Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
• Refactor redirect handling in UrlHandlerFilter #37030
• Revise stylesheet source handling in XsltView #37029
• Revise view name handling in UrlFilenameViewController #37027
• Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
• Improve WebSocket handshake error logging #37023
• Fix missing nullability in JdbcTemplate.batchUpdate #37012
• Timeout property in RetryPolicy does not have a default constant #36983
• Write native configuration files as UTF-8 #36972
• DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
• Perform nextKey within synchronization for SQLite as well #36959
• Add support for custom ObjectInputFilter on DefaultDeserializer #36958
• Revise resource bundle caching for common locales #36957
• Improve nullability for getSession(*) in MockHttpServletRequest #36926
• Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
• Improve ambiguous match check on preflight request #36903
• Improve Groovy markup template loading #36902
• Improve request path handling on a Reactor Netty server #36893
• Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

• EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
• MetadataReader fails to read byte[] array from annotation #37083
• Ensure parsing/tostring symmetry in ContentDisposition #37064
• Character outside of permitted range in Content Disposition #37062
• Release Jackson BufferRecycler to its pool in encoders #37059
• Ensure consistent error escaping #37055
• Refine template name processing #37054
• Reset TwoByteMatcher partial match on mismatching byte #37053
• Refactor async XML parsing limit checks #37031
• Fix part constraint checks in PartEventHttpMessageReader #37028
• Fix buffer leak in RSocket SETUP frame handling #37026
• Ensure correct Jetty core response cookie handling #37025
• Align domainToAscii with current WhatWG spec #37018
• Ensure consistent ButtonTag value attribute processing #37017
• SpEL's InlineList is cached as a mutable list in compiled mode #37001
• Write native configuration file when only lambda hints are present #36989
• SpEL Indexer reuses invalid cached PropertyAccessor #36986
• SpEL reuses invalid cached ConstructorExecutor #36985
• MimeTypeUtils raises StringIndexOutOfBoundsException for some invalid mime types #36971
• Ignore DOCTYPE inside a multi-line comment body #36948
• Avoid divide-by-zero in ExponentialBackOff jitter #36932
• Refactor use or close lock in ConcurrentWebSocketSessionDecorator #36909
• Host header initialization breaking change in StompRelayMessageBrokerHandler #36907
• Remote address checks for SockJS session #36681 breaks xhr-polling #36904
• LifeCyclePrintWriter does not delegate correctly #36885
• IllegalArgumentException when creating named native query via Shared EntityManager with Hibernate 8.0.0-SNAPSHOT / JPA 4.0.0-M4 #36878

📔 Documentation

• Document AOP proxy semantics for Bean Overrides in tests #37121
• Provide guidance for object model design in SpEL #37102
• Fix Javadoc error in ProtobufDecoder #37079
• Document security implications of evaluating untrusted SpEL expressions #36997
• Document relationships between expressions, evaluation contexts, and accessors in SpEL #36968
• Update Javadoc for @ActiveProfiles ordering #36950
• Document behavior for 0 delay combined with jitter in backoff policies #36946
• Clarify design goal of UrlFilenameViewController in Javadoc #36906

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.16.7 and Tracing 1.6.7 [#3710...

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

• CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
• CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
• CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
• CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
• CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
• CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
• CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
• CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
• CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
• CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
• CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
• CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
• CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
• CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
• CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
• CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

• Include zone ID in CronTrigger's equals/hashCode implementations #36871
• Expose ClassLoader from DefaultDeserializer #36833
• Use immutable map for SEPARATORS static field in DefaultPathContainer #36821
• Track operations during SpEL expression evaluation #36801
• Ensure getters have non-void return types in SpEL #36800
• Avoid too many character access attempts in AntPathMatcher #36799
• Refine default view name resolution #36793
• Refine Jackson JMS converters #36791
• Improve ABNF rule checks in RfcUriParser #36787
• Restrict SpringVersion.getVersion() to "major.minor.patch" format #36785
• Runtime compatibility with JPA 4.0 M4 and corresponding Hibernate 8.0 snapshots #36784
• Allow specifying the charset to use in ExchangeFilterFunctions#basicAuthentication #36777
• Use CollectionUtils to initialize HashMap in DefaultUriBuilderFactory #36763
• Improve error messages in SpEL #36756
• Improve pattern caching in SpEL #36755
• Avoid ResolvableType#forType contention for implicit cache cleanup #36745
• Switch to JdkIdGenerator for WebSocket Sessions #36740
• Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #36727
• LiteWebJarsResourceResolver does not resolve directories #36726
• Warn against unsafe static resource locations in MVC and WebFlux #36692
• Consistent compatibility with Woodstox as an alternative to Xerces #36682
• Improve principal checks for SockJS session #36681
• Set host header consistently in STOMP relay CONNECT frames #36673
• Support Micrometer context propagation in Kotlin Flow #36667
• Reliable detection of broadcast messages in UserDestinationMessageHandler #36662

🐞 Bug Fixes

• Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #36869
• Server Sent Event does not support multi-line comments #36866
• CronExpression skips days on midnight DST gap #36865
• Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #36835
• Preserve generic type info in awaitEntity() #36834
• Bean Background Bootstrap and Lazy Init #36844
• Back-off for DefaultMessageListenerContainer with OracleAQ has changed and is very short in SpringBoot 4 #36809
• Character outside of permitted range in Content Disposition #36805
• Fix JSP tag processing #36797
• Fix script processing capabilities #36795
• Jaxb2XmlEncoder exclusivity prevents JacksonXmlEncoder usage and hinders POJO serialization #36776
• JacksonXmlEncoder.canEncode incorrectly returns true for String body with application/xml #36775
• Consistently expose map key quotes in PropertyAccessorUtils #36765
• Fix fragment parsing for relative URI in RFC URI parser #36762
• Fix race condition in InMemoryWebSessionStore #36742
• Parsing failure for MIME type with quoted parameter values #36730
• Circular dependency between supplier-created beans is silently ignored on startup #36725
• Data is lost for joined DataBuffer in DataBufferUtils #36714
• Cache collisions in CachingResourceResolver #36713
• Unexpected path element removal when resolving versioned resources #36698
• Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #36694
• Regression on value class parameter handling #36665
• Fix inverted logic for boolean last flag in JettyWebSocketSession when sending binary message #36650
• Parent traceId is not reused when calling WebClient.awaitExchange function #36182

📔 Documentation

• Fix broken links to Selenium documentation #36875
• Fix applicability note on setAutoGrowCollectionLimit #36863
• Document @Conditional gating of nested @Configuration classes #36831
• Javadoc of nestingLevel parameter in MethodParameter constructor is inconsistent with actual implementation #36826
• Re-structuring of Data Binding C...

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

• CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
• CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
• CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
• CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
• CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
• CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
• CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
• CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
• CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
• CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
• CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
• CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
• CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
• CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
• CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
• CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

• Avoid too many character access attempts in AntPathMatcher #36886
• Track operations during SpEL expression evaluation #36887
• Ensure getters have non-void return types in SpEL #36888
• Expose ClassLoader from DefaultDeserializer #36839
• Refine default view name resolution #36794
• Refine Jackson JMS converters #36792
• Improve ABNF rule checks in RfcUriParser #36788
• Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #36728
• Warn against unsafe static resource locations in MVC and WebFlux #36693
• Consistent compatibility with Woodstox as an alternative to Xerces #36683

🐞 Bug Fixes

• Data is lost for joined DataBuffer in DataBufferUtils #36874
• CronExpression skips days on midnight DST gap #36873
• Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #36870
• Server Sent Event does not support multi-line comments #36867
• Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #36849
• Bean Background Bootstrap and Lazy Init #36847
• Fix JSP tag processing #36798
• Fix script processing capabilities #36796
• Parsing failure for MIME type with quoted parameter values #36734
• Circular dependency between supplier-created beans is silently ignored on startup #36732
• Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #36722
• Regression on value class parameter handling #36720
• Cache collisions in CachingResourceResolver #36718
• Unexpected path element removal when resolving versioned resources #36699

📔 Documentation

• Fix broken links to Selenium documentation #36877
• Fix applicability note on setAutoGrowCollectionLimit #36864
• Javadoc of nestingLevel parameter in MethodParameter constructor is inconsistent with actual implementation #36848

🔨 Dependency Upgrades

• Upgrade to JUnit 5.14.4 #36707
• Upgrade to Micrometer 1.15.12 #36881
• Upgrade to Reactor 2024.0.18 #36882

⭐ New Features

• Improve SpringValidatorAdapter and MethodValidationAdapter performance #36621
• Support JSON array decoding to Flux in KotlinSerializationJsonDecoder #36597
• Deprecate methodIdentification() in CacheAspectSupport for removal #36575
• Add MockRestServiceServer#createServer variant for RestClient #36572
• Create RestClientXhrTransport variant replacing RestTemplateXhrTransport #36566
• Improve error handling in multipart codecs #36563
• Make ApplicationListenerMethodAdapter#getTargetMethod() public #36558
• ApiVersionConfigurer.setSupportedVersionPredicate() returns void instead of ApiVersionConfigurer #36551
• LazyConnectionDataSourceProxy does not work well with Hibernate's multi-tenancy by schema strategy #36527
• Add registerManagedResource variant with bean key argument to MBeanExporter #36520
• Handle blank Accept-Language header in AcceptHeaderLocaleResolver #36513
• Make AbstractStreamingClientHttpRequest and AbstractBufferingClientHttpRequest public #36501
• MySQL Error 149 (Galera/WSREP conflict) not translated to ConcurrencyFailureException in Spring JDBC/ORM #36499
• Add PreFlightRequestFilter #36482
• Support configuration of extension context scope for SpringExtension via Spring or JUnit properties #36460
• Lower log level of "Cache miss for REQUEST dispatch" in HandlerMappingIntrospector #36309

🐞 Bug Fixes

• WebDataBinder unnecessarily instantiates collections when using the "!" and "_" prefixes #36625
• Cache pollution from high-cardinality FieldError default messages in MessageSourceSupport #36609
• MergedAnnotation does not use ClassLoader for method or field #36606
• @Sql fails if DataSource is wrapped in a TransactionAwareDataSourceProxy #36611
• AnnotatedTypeMetadata no longer retains source declaration order on Java 24+ #36598
• MergedAnnotation.asMap() fails when an attribute references a non-existent class #36586
• FileSystemResource does not strictly follow the Resource#isReadable() contract #36584
• Converter overrides in HttpMessageConverters only apply when defaults are registered #36579
• Invalid method return type metadata for ClassFile variant on JDK 24+ #36577
• Fix Writer lifecycle for AbstractJsonHttpMessageConverter.writeInternal(Object, Type, Writer) #36565
• Flushing-related regression in SseServerResponse #36537
• LazyConnectionDataSourceProxy does not pass on holdability to target Connection #36528
• AnnotationBeanNameGenerator fails when an annotation references a non-existent class #36524
• Perserve default API version in RestClientAdapter #36514
• Inconsistent codings resolution in resource resolvers #36507
• DefaultJmsListenerContainer may hang in an endless loop in doShutdown #36506
• Query not hidden in DefaultClientResponse checkpoint #36502
• RestClient closes stream for ResponseEntity responses #36492
• IllegalStateException when using websocket handshake headers with Tomcat #36486
• Invalid nullness information for ParameterizedTypeReference #36477
• WebTestClient cannot assert null list elements #36476
• Handle Kotlin nullable value class param correctly in CoroutineUtils #36449
• Remove RFC 2047 encoding from Content-Disposition filename #36328

📔 Documentation

• Clarify semantics of HttpMethod.valueOf() #36652
• Document whitespace semantics in SpEL expressions #36628
• Document that spring.profiles.active is ignored by @ActiveProfiles #36600
• MergedAnnotation.asAnnotationAttributes() Javadoc incorrectly states that it creates an immutable map #36567
• Fix incorrect Javadoc in HandlerMethodReturnValueHandlerComposite regarding caching #36555
• Fix incorrect method name in TypeDescriptor.array() Javadoc #36549
• Introduce Kotlin examples for Bean Overrides (@MockitoBean, etc.) #36541
• Fix incorrect cross-reference links in AbstractEnvironment Javadoc #36516
• Document RetryTemplate#invoke variants in reference manual #36452
• Link observability section to Micrometer Observation Handler docs #34994

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.16.5 #36659
• Upgrade to Reactor 2025.0.5 #36658

❤️ Contributors

Thank you to all the contributors who worked on this release:

@Mohak-Nagaraju, @Sineaggi, @T45K, @angry-2k, @bebeis, @cookie-meringue, @dmitrysulman, @elgunshukurov, @itsmevichu, @junhyung8795, @msridhar, @nameearly, @tobifasc, and @xxxxxxjun

⭐ New Features

• Improve SpringValidatorAdapter and MethodValidationAdapter performance #36624
• Add missing @Deprecated(forRemoval = true) for deleted in 7.0 #36591
• Deprecate methodIdentification() in CacheAspectSupport for removal #36576
• Improve error handling in multipart codecs #36564
• LazyConnectionDataSourceProxy does not work well with Hibernate's multi-tenancy by schema strategy #36529
• MySQL Error 149 (Galera/WSREP conflict) not translated to ConcurrencyFailureException in Spring JDBC/ORM #36510

🐞 Bug Fixes

• Handle Kotlin nullable value class param correctly in CoroutineUtils #36643
• NullPointerException in ServerSentEvent when trying to set id or event properties #36634
• @Sql fails if DataSource is wrapped in a TransactionAwareDataSourceProxy #36630
• WebDataBinder unnecessarily instantiates collections when using the "!" and "_" prefixes #36627
• Cache pollution from high-cardinality FieldError default messages in MessageSourceSupport #36623
• ContentCachingRequestWrapper does not allow unlimited content caching #36620
• MergedAnnotation does not use ClassLoader for method or field #36614
• AnnotationBeanNameGenerator fails when an annotation references a non-existent class #36588
• FileSystemResource does not strictly follow the Resource#isReadable() contract #36585
• Query not hidden in DefaultClientResponse checkpoint #36571
• LazyConnectionDataSourceProxy does not pass on holdability to target Connection #36530
• DefaultJmsListenerContainer may hang in an endless loop in doShutdown #36511
• Inconsistent codings resolution in resource resolvers #36508

📔 Documentation

• Clarify semantics of HttpMethod.valueOf() #36653
• Document that spring.profiles.active is ignored by @ActiveProfiles #36636
• Document whitespace semantics in SpEL expressions #36629
• MergedAnnotation.asAnnotationAttributes() Javadoc incorrectly states that it creates an immutable map #36568
• Introduce Kotlin examples for Bean Overrides (@MockitoBean, etc.) #36542
• Fix incorrect cross-reference links in AbstractEnvironment Javadoc #36517

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.15.11 #36661
• Upgrade to Reactor 2024.0.17 #36660

⚠️ Attention Required

• Log warning when default context configuration is ignored within test class hierarchies #36390
• Ignore flush calls on ServletServerHttpResponse body outputstream #36385

⭐ New Features

• Leverage ResourceHandlerUtils in ScriptTemplateView #36458
• Restore ScriptTemplateViewTests #36456
• Fix log message in ConfigurationClassBeanDefinitionReader #36453
• DefaultResponseErrorHandler - setMessageConverters() not called via RestClient #36434
• Resolve context initializers only once in AbstractTestContextBootstrapper #36430
• Invoke resolveContextLoader() only once in AbstractTestContextBootstrapper #36425
• Further align synthesized annotation toString() with modern JDKs #36417
• Introduce setDefaultCharset() in AbstractResourceBasedMessageSource #36413
• Support for JPA 4.0 flush mode "explicit" #36401
• Support application-wide defaultHtmlEscape setting in WebFlux RequestContext #36400
• Support Predicate<RequestPath>> in path API version resolver #36398
• Avoid duplicate flushes in HttpMessageConverter implementations #36383
• Add support for non-flushing OutputStream to StreamUtils #36382
• Make it easier to get InputStream from RestClient #36380
• RuntimeHintsWriter should comply with reachability-metadata-schema-v1.2.0.json #36379
• Make it easier to create custom HttpExchangeAdapter #36374
• Improve ResourceHttpMessageConverter target type support #36368
• org.springframework.test.web.servlet.assertj.AbstractHttpServletResponseAssert#headers case sensitivity #36349
• Allow registering serialized lambda metadata through RuntimeHints #36339
• Refactor calculateHashCode in RequestMappingInfo #36325

🐞 Bug Fixes

• MetadataReader misses enclosing class name for Kotlin nested classes with Java 24+ #36451
• Guard against invalid id/event values in Server Sent Events #36440
• Component scanning fails against non-loadable annotation type with enum array on Java 25 #36432
• Duplicate ServletServerHttpRequest headers #36418
• Incomplete debug message in ConfigurationClassBeanDefinitionReader #36410
• Inconsistent ApplicationEventMulticaster state after removing ApplicationListener implemented by FactoryBean #36404
• Propagate max frame length to WebSocket session #36370
• Graceful shutdown of SimpleAsyncTaskExecutor #36362
• Duplicate response headers with ResponseEntity<Mono<T>> (or Kotlin suspend function) controller method #36357
• HttpServiceProxyFactory returns LinkedHashMap instead of target type for method with generic return type #36326
• HttpMediaTypeException thrown when calculating compatible media types #36300

📔 Documentation

• Document FullyQualifiedConfigurationBeanNameGenerator in Javadoc and reference docs #36455
• Document @Fallback alongside Primary in the reference manual and @Bean Javadoc #36439
• Fix links to UriComponentsBuilder and polish examples #36403
• Emphasize @Configuration classes over XML and Groovy in testing chapter #36393
• Document tips to avoid issues with ignored default context configuration in tests #36392
• Polish SpEL operator examples in reference docs #36367
• Add programmatic configuration tabs in the transactional refdoc #36323
• Document registration recommendations for BeanPostProcessor and BeanFactoryPostProcessor #34964

🔨 Dependency Upgrades

• Upgrade to JUnit 6.0.3 #36389
• Upgrade to Micrometer 1.16.4 #36444
• Upgrade to Reactor 2025.0.4 #36443

❤️ Contributors

Thank you to all the contributors who worked on this release:

@AgilAghamirzayev, @aavoronin93, @cetf9h, @froggy0m0, @gbouwen, @husseinvr97, @jisub-dev, @ngocnhan-tran1996, @siom79, and @xxxxxxjun