Spring Cloud 2025.1.3 "Oakwood" Ships a Large Coordinated Security Patch
Spring Cloud 2025.1.3, code-named "Oakwood," released on August 20, addresses more than fifteen CVEs across the release train's most widely used modules. Spring Cloud Config received the heaviest set of fixes — four CVEs (CVE-2026-47836, CVE-2026-47837, CVE-2026-47894, and CVE-2026-59315) covering a TOCTOU race condition, insufficient webhook validation, environment repository data exposure, and a denial-of-service vector. Spring Cloud Function resolved six issues, including a combined arbitrary file read and SSRF vulnerability along with improper HTTP header filtering and sensitive data appearing in logs. Spring Cloud Stream closed a further six CVEs related to logging, caching, content-type handling, and deserialization risk, and additional fixes landed in Spring Cloud Commons and Gateway.
Beyond the security work, the release updates the bundled Bouncy Castle dependency to 1.85.2 and is built against Spring Boot 4.0.8. On the feature side, Spring Cloud Config now supports Git-style searchPaths wildcards when backed by an AWS S3 bucket, simplifying configuration layout for teams storing environment-specific properties in S3, and Spring Cloud Gateway gained retry backoff support in its MVC-based implementation. Given the volume and severity of the Config and Function CVEs, teams running earlier 2025.1.x releases should prioritize the upgrade rather than treat it as routine maintenance.
Read more — Spring Blog
