4/9/24, 3:17 PM

Spring Health Assessment | VMware Tanzu

Tanzu

Spring Health Assessment
Created on Apr 08, 2024

23Total Spring libraries usedOSS Support Status

Security Vulnerabilities

61%
Libraries without
OSS Support

Upgrade Effort

74%
Libraries with
Vulnerabilities

Findings

96%
Libraries with High
Effort Upgrades

Recommendations

Your percentage of supported libraries will reduce from 39%

Purchase Spring Runtime to extend your support until

to 0% over the next 4 months.

Apr 08, 2025, for 23 libraries which are set to expire in4 months.

You have 17 libraries with security vulnerabilities.
Upgrade 17 libraries with identified vulnerabilities.
22 of you libraries are likely to require High engineering effort
to upgrade.

Questions? Get help from Tanzu Labs to upgrade your apps.

OSS Support Status

961%
Libraries without
OSS Support

Opensource

14
Commercial

0
Unsupported

https://tanzu.vmware.com/spring-health-assessment

1/6

4/9/24, 3:17 PM

Spring Health Assessment | VMware Tanzu

Security Vulnerabilities

6Upgrade Effort

Critical

1174%
Libraries withVulnerabilities

22High0Moderate

High96%
Libraries with High
Effort Upgrades

1
Moderate00LowLow

6None

Get Help
Elevate your development with exclusive enterprise features and commercial Spring support
Discover the power of VMware Tanzu Spring Runtime. Benefit from 24x7 support for the entire Spring ecosystem, andget packaged versions of popular projects tailored for seamless integration with Kubernetes—all built by the core Spring
engineering team.
Learn more

Own your modernization journey
VMware Tanzu Spring Consulting (formerly Pivotal Labs) partners with organizations worldwide to accelerate the deliveryof software and modernize legacy apps, while reducing operating costs and risk.
Learn more

Run Spring Health Assessment across your portfolio & upgrade to SpringBoot 3 automaticallyJoin the Spring Design Partner Program to use the Spring Health Assessment on a larger scale and automatically upgrade
your Spring libraries and APIs to the latest versions minimizing the amount of breaking changes. Simply reach out toshar-sdp.PDL@broadcom.com before the 16th of February 2024 to request access to the program.
Learn more

Libraries
Sort by:https://tanzu.vmware.com/spring-health-assessment

Support2/6

4/9/24, 3:17 PMSpring Health Assessment | VMware Tanzuorg.springframework.boot:spring-boot:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

3

HIGH

SUPPORTED

Effort

HIGH

Vulnerabilities
Vulnerability

StatusTransitive dependency CVE

Spring Framework vulnerable to denial of service

HIGH

YES

CVE-202320863

Spring Boot denial of service vulnerability

MODERATE NO

CVE-202334055

Spring Framework vulnerable to denial of service via
specially crafted SpEL expression

CVE-2023MODERATE YES

20861

Upgrade Plan
Upgrade Step

EffortUpgrade spring-boot from 2.7.x to 3.2.x

HIGHorg.springframework.boot:spring-boot-autoconfigure:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

4

HIGH

SUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-starter-tomcat:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

6

HIGH

SUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-actuator:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

3HIGHSUPPORTED

EffortHIGH

io.micrometer:micrometer-core:1.9.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

0NONE

SUPPORTED

EffortMEDIUM

org.springframework.boot:spring-boot-starter-web:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

23

CRITICALSUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-starter:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

https://tanzu.vmware.com/spring-health-assessment

12HIGHSUPPORTED

EffortHIGH

3/6

4/9/24, 3:17 PM

Spring Health Assessment | VMware Tanzuorg.springframework.boot:spring-boot-actuator-autoconfigure:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

7

CRITICALSUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-starter-logging:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

1

HIGH

SUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-test-autoconfigure:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

4

HIGH

SUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-test:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

3

HIGH

SUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-starter-actuator:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

15

CRITICALSUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-starter-json:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

17

CRITICALSUPPORTED

EffortHIGH

org.springframework.boot:spring-boot-starter-test:2.7.1
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2023-11-24

2025-08-24

14

HIGH

SUPPORTED

EffortHIGH

org.springframework:spring-core:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

0NONE

SUPPORTEDEffort

HIGH

org.springframework:spring-expression:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

2HIGH

SUPPORTED

EffortHIGH

org.springframework:spring-aop:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

0NONE

SUPPORTED

EffortHIGH

org.springframework:spring-test:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

https://tanzu.vmware.com/spring-health-assessment

0NONESUPPORTED

EffortHIGH

4/6

4/9/24, 3:17 PM

Spring Health Assessment | VMware Tanzuorg.springframework:spring-webmvc:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

5CRITICALSUPPORTED

EffortHIGH

org.springframework:spring-jcl:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

0NONE

SUPPORTED

EffortHIGH

org.springframework:spring-beans:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

0NONE

SUPPORTED

EffortHIGH

org.springframework:spring-context:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

2HIGH

SUPPORTED

EffortHIGH

org.springframework:spring-web:5.3.21
OSS support ends Commercial support ends Vulnerabilities Vulnerability status Support status

2024-08-31

2026-12-31

3

CRITICALSUPPORTED

EffortHIGH

Understanding Effort & Support Levels
EffortHIGH
Requires extensive refactoring for dependency upgrades.

MODERATESupport
SUPPORTED
Currently under open-source support.

SUPPORTED

Needs some manual updates due to major changes inUnder commercial support, with extended updates for Tanzu

dependencies.

customers.

LOWSimple version update, no significant code changes.

UNSUPPORTED
No longer supported, no updates available.

Disclaimer and Known Limitations
Please Read Carefully
This report provides an assessment of the Spring libraries used within your project, detailing support status, security vulnerabilities,and migration efforts. It is essential to understand the scope and limitations of this assessment:
Our vulnerabilities database is updated every 3 hours. If a new vulnerability appears over that period, it will not be included in thereport.
The vulnerabilities introduced by transitive dependencies do not consider overridden versions through dependency management.
The vulnerabilities introduced by optional transitive dependencies are not considered.
You do not always require full upgrade to mitigate the vulnerabilities reflected in the report. Sometimes, you can alternativelyoverwrite a dependency.
Projects with N/A dates include projects that are run by the community or are not yet supported by the Spring team.
This service is still in BETA, which means that we can not guarantee a 99.5 availability.
https://tanzu.vmware.com/spring-health-assessment

5/6

4/9/24, 3:17 PMSpring Health Assessment | VMware Tanzu

Should you encounter any issues or anomalies in this report not listed above, we strongly encourage you to contact our support teamfor a detailed review and assistance in UTC+1 working hours.

Support Contact
Email: shar-support.PDL@broadcom.com
For support, reach out to us through the contact options above, and we will be glad to assist you during working hours.

https://tanzu.vmware.com/spring-health-assessment

6/6