Spring Cloud 2025.1.3 (Oakwood) Ships with a Stack of Security Fixes

The Spring Cloud team has rolled out the 2025.1.3 release train, codenamed Oakwood, built on Spring Boot 4.0.8. This is a maintenance release, but don't let the patch number fool you—it's packed with security fixes that touch almost every major module.

Security fixes dominate

Spring Cloud Config gets the most attention with four CVEs addressed: a TOCTOU attack when using SVN, a monitor endpoint that failed to validate webhook requests, exposure of the native environment repository, and a denial-of-service in the monitor. If you're running Config Server with SVN or have the monitor endpoint exposed, you'll want to upgrade ASAP.

Spring Cloud Function also gets a handful of fixes, including a potential arbitrary file read and SSRF, incorrect URI security determination, improper HTTP header filtering, composition lookup poisoning, and sensitive data logging in AWS and Azure bindings. Gateway patches an SSRF and native file access issue with gRPC, and Stream fixes several issues including deserialization of untrusted types and improper caching of content types.

Commons addresses CVE-2026-59284, which relates to the writable env actuator endpoint's allow list, and upgrades Bouncycastle to 1.85.2 with a new BOM.

Functional improvements

Beyond security, there are a few quality-of-life changes. Config now supports Git-style searchPaths with wildcards in AWS S3 buckets. Gateway adds MVC retry backoff support. Commons gets several fixes around configuration property resetting—no more recursive resets for library types, skipping beans without default constructors, and autowiring beans when rebinding.

Module versions

Most modules are at 5.0.3, with Config at 5.0.5, Function at 5.0.4, and the starter build at 2025.1.3. The full list includes Build, Bus, Circuitbreaker, Commons, Consul, Kubernetes, Openfeign, and Stream.

Upgrade path

As usual, you can pull the BOM from Maven Central. The release notes on GitHub have the full details, but the short version is: if you're on any 2025.1.x line, this is a recommended upgrade—especially if you're exposed to any of the patched CVEs.