Spring Ecosystem Update: Spring Framework 6.2.17 and 7.0.6 Maintenance Releases, 2026-03-26
java

Spring Ecosystem Update: Spring Framework 6.2.17 and 7.0.6 Maintenance Releases, 2026-03-26

2 min read

Spring Framework 6.2.17 and 7.0.6 Released

The Spring team released simultaneous maintenance updates for both active Spring Framework branches on March 13, 2026. Spring Framework 6.2.17 delivers 26 fixes and documentation improvements, while Spring Framework 7.0.6 ships 45 fixes and documentation improvements — a combined total of 71 resolved issues across both supported tracks. These patch releases follow the regular monthly cadence that the Spring team has maintained throughout the 6.2.x and 7.0.x release cycles.

Among the notable fixes in both releases are extra resource handling checks added to the ScriptTemplateView class via the ResourceHandlerUtils utility. This change aligns script template view resource handling with the security posture already in place for static resource handling, ensuring that template resolution is subject to the same path-traversal protections. The releases also restore ScriptTemplateViewTests in both WebFlux and WebMVC, which were inadvertently deleted in a prior commit — a regression that affected any projects relying on those test utilities.

From a dependency management perspective, Spring Framework 6.2.17 shipped alongside Spring Boot 3.5.12, while Spring Framework 7.0.6 is paired with Spring Boot 4.0.4. The Spring Boot 4.0.4 release — which fixed two Actuator authentication bypass CVEs (CVE-2026-22731 and CVE-2026-22733) — therefore also brings in Spring Framework 7.0.6 automatically. Teams who already upgraded to Spring Boot 4.0.4 for the security fixes have already received the 7.0.6 improvements without a separate step.

The parallel maintenance of the 6.2.x and 7.0.x branches reflects Spring's commitment to supporting teams on different migration timelines. Projects still on Spring Boot 3.5.x benefit from ongoing 6.2.x fixes while planning their Spring Boot 4.0 migration, while teams already on Spring Boot 4.0.x continue to receive corrections on the 7.0.x track. Both branches will remain in active maintenance through their respective end-of-life dates.

Read moreSpring.io


Stanislav Lentsov

Written by

Stanislav Lentsov

Software Architect

You May Also Enjoy