Dependency health Workspace Pro coming soon

org.springframework:spring-webmvcMaven Central · Java

Vulnerabilities, end of life and next steps

Check a specific version for known advisories, documented mitigations and evidence-backed earlier-version options. Maintenance health is separate from vulnerability status.

Review remediation options →

⚠ Known vulnerability history

Reference sources checked 2026-10-08; this is selected historical context, not a complete vulnerability scan.

These advisories relate to this package’s identity. We have not verified your installed version or deployment. This context is separate from its maintenance score.

CVE-2022-22965 · Spring4Shell ↗

Historical affected branches include 5.3.0–5.3.17 and 5.2.19 and earlier. Exploitability depends on runtime and deployment; consult Spring’s advisory.

How these vulnerabilities relate to package checks →
What the project says about itself
  • Security policy — published. Source: the repository.
  • Open milestones — General Backlog 0/124 done; 7.0.x 0/4 done; 7.x 0/23 done; 7.1.x 0/28 done; 7.1.1. Source: the repository's milestones.
  • OpenSSF Scorecard — 6 / 10 on 2026-08-24. Source: OpenSSF, via deps.dev. A third party's view of security practice, not part of the health score.

Third-party facts checked yesterday; registry facts on every crawl.

State history 1
WhenChange
2026-11-05 first verdict: active

Badge

maintenance: active

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/maven/org.springframework:spring-webmvc.svg)](https://isitdeadyet.dev/maven/org.springframework:spring-webmvc)

Watch it

Get told when org.springframework:spring-webmvc changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.