Broadcom said Tuesday, Oct. 27, that it delivered fixes for 89 vulnerabilities in TrueSource Spring Enterprise to critical infrastructure and other qualifying early-access customers ahead of public disclosure. It also introduced tools intended to help companies identify affected applications and deploy patches.
For security teams, the practical question is which applications need those fixes and whether updates reach production. Finding a vulnerable dependency, approving a change, and confirming deployment are separate steps.
New tools target patching gap
Broadcom acknowledged that patches only protect systems once they are deployed, a central concern in patch management. To address that gap, the company added TrueSource Hub, which connects to code repositories and provides a live view of which Spring applications need fixes and which versions are out of support.
The company also introduced build plugins for Application Advisor that integrate with existing Maven and Gradle workflows, automatically generating pull requests for approved fixes. Additionally, an integration with JFrog Zero-Touch Remediation delivers verified fixes directly into builds.
Scale of the effort
Broadcom reported that its engineers fixed 406 new vulnerabilities in Spring and Reactor libraries during 2026, delivering more than 1,090 total fixes, including 798 backports. The team reviewed over 2,600 security reports and filtered out more than 3,000 false alarms.
Earlier fixes included CVE-2026-41855, a high-severity Spring Framework deserialization flaw affecting untrusted JMS environments; CVE-2026-47691, a Netty DNS cache-poisoning flaw currently rated 8.7 by its maintainers; and CVE-2026-67404, a RabbitMQ flaw rated 9.2 that could allow forged authentication tokens under specific OAuth2 and certificate configurations.
"Security isn't a one-time initiative; it's an ongoing commitment," said Purnima Padmanabhan, general manager of Broadcom's Tanzu Division. "In June, we pledged to identify and resolve Spring vulnerabilities faster than ever, and today's release demonstrates our continued momentum."
What security teams should verify before deploying fixes
Start by mapping Spring applications to their dependencies, supported release lines, and application owners. Ask Broadcom which newly announced fixes apply to those deployments and whether the organization qualifies for early access. A portfolio-wide vulnerability count does not establish an individual application’s exposure.
The Application Advisor plugins generate reviewable pull requests, while the JFrog integration delivers fixes directly into builds, according to Broadcom. Teams should establish which path each application uses, who approves changes, and what testing must pass before deployment. Automated patch management should fit existing change controls and rollback procedures.
Compatibility with existing vulnerability management tools also needs checking. Broadcom describes Snyk’s recognition of its patched Spring versions as an ongoing partnership. Confirm whether the scanner in use recognizes the exact patched artifact before suppressing a finding; retain the vendor advisory and package evidence supporting that decision.
Build records can help document which libraries an application contains, but teams should also verify that the resulting artifact reached the running workload. A merged pull request or successful build should not, by itself, close a remediation ticket.
Before adopting the workflow, IT leaders should confirm licensing costs, repository-access requirements, audit-data exports, and compatibility with existing security tools. The useful measure is whether the process reduces the time affected applications remain exposed while preserving testing, approval, and deployment evidence.
Broadcom says TrueSource Spring Enterprise, including Hub and the build plugins, is generally available. Access to the newly announced fixes is initially limited to qualifying early-access and critical infrastructure customers, with public vulnerability details and CVE publication to follow.
Read more: For patching needs beyond Spring applications, compare patch management providers by coverage, automation, and deployment controls to assess how they fit your wider environment.