Spring Security 6.x — End of Life
EOLSpring Security 6.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 6.5 | May 19, 2025 | — | Jun 30, 2026 | 6.5.11 | EOL | |
| 6.4 | Nov 18, 2024 | — | Dec 31, 2025 | 6.4.13 | EOL | |
| 6.3 | May 20, 2024 | — | Jun 30, 2025 | 6.3.10 | EOL | |
| 6.2 | Nov 20, 2023 | — | Dec 31, 2024 | 6.2.8 | EOL | |
| 6.1 | May 15, 2023 | — | Jun 30, 2024 | 6.1.9 | EOL | |
| 6.0 | Nov 21, 2022 | — | Dec 31, 2023 | 6.0.8 | EOL |
CVEs affecting Spring Security 6.x (0)
Spring Security 6.x is EOL — migrate to Spring Security 7.x
Spring Security 7.x is the next major release. Plan your upgrade before Spring Security 6.x stops receiving security patches.
Frequently asked questions
Is Spring Security 6 end of life?
Yes. All Spring Security 6.x releases have reached end of life and no longer receive security patches. Migrate to Spring Security 7.x as soon as possible.
What CVEs affect Spring Security 6?
No CVEs are currently tracked for Spring Security 6.x in our database. This may mean no vulnerabilities have been recorded yet, or the data is still syncing.
What is the latest Spring Security 6 version?
The latest Spring Security 6.x patch release is 6.5.11, released on June 9, 2026. Always run the latest patch to benefit from all security fixes.
How to migrate from Spring Security 6 to Spring Security 7?
To migrate from Spring Security 6 to Spring Security 7: (1) review the official Spring Security 7 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Spring Security 6 in production?
No. Spring Security 6 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA