Broadcom Fixes 89 New Open Source Vulnerabilities in TrueSource Spring Enterprise, Reaching 408 Total in 2026
PALO ALTO, Calif., Oct. 27, 2026 (GLOBE NEWSWIRE) — Broadcom Inc. (NASDAQ: AVGO), a global technology leader that designs, develops, and supplies semiconductor and infrastructure software solutions, today shipped fixes for 89 novel vulnerabilities in TrueSource Spring Enterprise to its critical infrastructure customers and others who qualify for early access, ahead of public disclosure. This brings the total number of vulnerabilities fixed across TrueSource offerings to 408.
Patches only secure an environment once deployed. To close that gap, Spring Enterprise adds TrueSource Hub to help enterprises assess application exposure, prioritize critical fixes, and track status. Additionally, build plugins for Application Advisor automate patching within existing Maven or Gradle workflows, generating update pull requests to streamline merging approved fixes.
A sustained investment in open source security
Building on its June 2026 open source commitment, Broadcom uses Frontier AI scanning and advanced research to find and fix vulnerabilities. TrueSource Spring Enterprise delivers simultaneous fixes across all supported versions, giving legacy releases immediate access, while providing security-only patches for current versions to speed deployment. Detailed vulnerability information will be published when fixes reach the community and CVEs are issued.
Scale & Impact: Reaching a massive footprint of downloads of Spring and Reactor libraries in 2026, Broadcom engineers fixed 406 new vulnerabilities, delivered over 1,090 fixes (including 798 backports), reviewed 2,600+ reports, and filtered out 3,000+ false alarms.
Key High/Critical Broadcom Fixes Earlier This Year:
- Spring (June): Fixed a remote code execution vulnerability (CVE-2026-41855, CVSS 8.1) across four supported lines simultaneously.
- Netty Dependency (June): Discovered a DNS redirection vulnerability (CVE-2026-47691, CVSS 10.0) and addressed with the community maintainers and fixed for all supported Spring versions.
- RabbitMQ (July): Fixed a credential forgery vulnerability (CVE-2026-67404, CVSS 9.2) across four supported lines at once.
“Security isn’t a one-time initiative; it’s an ongoing commitment. In June, we pledged to identify and resolve Spring vulnerabilities faster than ever, and today’s release demonstrates our continued momentum,” said Purnima Padmanabhan, general manager, Tanzu Division, Broadcom. “Our customers receive critical fixes early in a deployable format, with complete visibility into where patches belong and confirmation when they land. Crucially, fixes are contributed back to the open source community—because open source remains resilient only when businesses actively invest in ecosystem health.”
See it, prioritize it, fix it, prove it
Most enterprises know they run open source. Few can say exactly which applications run which versions, which are out of support, and which need a fix published this morning. TrueSource Spring Enterprise closes that gap with four capabilities that work together:
- Assess every repository. TrueSource Hub connects to an organization’s code repositories and shows the security state of the open source components every application depends on, across Java, Python, and JavaScript libraries, container images, and data services, along with its patch status, in a live view rather than a one-time audit.
- Prioritize the fixes that matter. When Broadcom publishes a fix, Hub shows which applications need it and how exposed they are, so security and engineering leaders can direct effort to the applications that carry the most risk. TrueSource works with the vulnerability scanners that teams already use. Snyk, for example, is actively partnering with Broadcom so that customers can recognize Broadcom-patched Spring versions as fixed, with the goal of reducing unnecessary alerts and keeping teams from chasing alerts for already-resolved vulnerabilities.
- Apply patches in the build. For Spring applications, Spring Application Advisor plugins integrate directly into existing Maven and Gradle builds. Fixes and version upgrades arrive as reviewable pull requests built on deterministic recipes verified by TrueSource engineers. Additionally, the new integration with JFrog Zero-Touch Remediation delivers instant protection. By automatically delivering verified, backward-compatible TrueSource fixes to builds, security teams can stop waiting on manual pull requests and dependency overrides – keeping software secure with zero friction.
- Prove it through pipeline audits. Every build records its source and the libraries it contains and reports that to TrueSource, so security leaders can show their boards and leadership exactly which libraries shipped and where each fix was applied.
The TrueSource portfolio
TrueSource by Broadcom is Broadcom’s portfolio of enterprise open source software, verified by engineers and delivered from one trusted source. It has three offerings:
- TrueSource Spring Enterprise for the Spring framework Broadcom maintains, with CVE-only patches, the security fix and nothing else, delivered for every supported version at the same time so teams can apply them without an upgrade, plus the tooling announced today.
- TrueSource Trusted Artifacts for verified open source libraries in Java, Python, and JavaScript, and the Secure Images catalog of container images, covering the middleware, runtimes, and backing services applications depend on.
- TrueSource Data Services for the data engines applications rely on: PostgreSQL, MySQL, Valkey, and RabbitMQ, with self-service provisioning, fleet management across environments, and enterprise support for the engines themselves, including prescribed high availability and disaster recovery.
Availability
TrueSource Spring Enterprise, featuring TrueSource Hub and build plugins, is generally available today. Its 87 fixes are accessible immediately to early-access and critical infrastructure customers, with public CVE release to follow. TrueSource Spring Enterprise, Trusted Artifacts, and Data Services are offered via tiered site licensing. Learn more at https://www.broadcom.com/products/software/truesource.
About Broadcom
Broadcom Inc. (NASDAQ: AVGO) is a technology leader that designs, develops, and supplies semiconductors and infrastructure software for global organizations’ complex, mission-critical needs. Broadcom combines long-term R&D investment with superb execution to deliver the best technology, at scale. Broadcom is a Delaware corporation headquartered in Palo Alto, CA. For more information, visit www.broadcom.com.
Broadcom and the pulse logo are among the trademarks of Broadcom. Postgres and PostgreSQL are registered trademarks of the PostgreSQL Community Association of Canada. MySQL is a registered trademark of Oracle Corporation. Valkey is a trademark of The Linux Foundation. All other trademarks are the property of their respective owners. Broadcom is not affiliated with, endorsed by, or sponsored by any of the foregoing organizations.
Media contact
John D’Avolio
Tanzu Division, Broadcom
+1.503.308.3096
