Update dependency org.springframework:spring-context to v6.2.7 [SECURITY] (main)

[renovatebot-confluentinc]

For any questions/concerns about this PR, please review the Renovate Bot wiki/FAQs, or the #renovatebot Slack channel.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.springframework:spring-context	6.2.5 -> 6.2.7

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Spring Framework DataBinder Case Sensitive Match Exception

CVE-2025-22233 / GHSA-4wp7-92pw-q264

More information

Details

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.

Affected Spring Products and Versions

Spring Framework:

• 6.2.0 - 6.2.6

• 6.1.0 - 6.1.19

• 6.0.0 - 6.0.27

• 5.3.0 - 5.3.42

• Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)	Fix Version	Availability
6.2.x	6.2.7	OSS
6.1.x	6.1.20	OSS
6.0.x	6.0.28	Commercial https://enterprise.spring.io/
5.3.x	5.3.43	Commercial https://enterprise.spring.io/

No further mitigation steps are necessary.

Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.

For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.

Credit

This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-22233
• https://github.com/spring-projects/spring-framework/issues/34801
• https://github.com/spring-projects/spring-framework/commit/edfcc6ffb188e4614ec9b212e3208b666981851c
• https://github.com/spring-projects/spring-framework/commit/ee62701f5634e904e42e218baad142cea2bcd332
• https://github.com/spring-projects/spring-framework
• https://spring.io/security/cve-2025-22233

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.