Package
apache-activemq-5.19
Component
spring-expression
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Spring Framework 5.3.39 is the final open-source release of the 5.3.x line, and the fix for this issue is published only in 6.2.19 and 7.0.8; the 5.3.x releases that carry it are distributed exclusively through commercial enterprise support and are not available from Maven Central, where 5.3.39 remains the newest 5.3.x artifact. Moving to the 6.2.x line is not possible in this release line because Spring Framework 6.x requires the Jakarta EE 9+ jakarta.servlet API while every servlet-facing class here is compiled against javax.servlet and the embedded HTTP layer is Jetty 9.4, a Servlet 3.1 container; the individual Spring modules are also version-locked to one another and to the surrounding Spring 5.x integration code, so none of them can be raised independently without the full javax to jakarta migration that upstream performs only in its 6.x release line.
Status