Security
Chainguard launches remediated Java libraries to address unpatched CVE backlog
The security vendor announces drop-in replacement libraries for Spring Boot that backport critical CVE fixes without requiring version upgrades.
The New Stack
Chainguard has launched Chainguard Libraries for Java in general availability, offering a new approach to managing the growing vulnerability debt that plagues legacy Java systems. The company is targeting the Spring Boot ecosystem first, backporting fixes for critical and high-severity CVEs across spring-boot, spring-framework, spring-security, and h2database.
The Java vulnerability problem#
The challenge is acute for the 90% of Fortune 500 companies that depend on Java for core systems. Many organizations run older framework versions that no longer receive upstream patches—Spring Boot 2.7, for example, reached end-of-life in November 2023 but carries 143 CVEs across 79 projects with no official fixes available. The problem is compounded by AI-assisted scanning tools generating hundreds of new security reports monthly, forcing teams to confront vulnerability backlogs they may lack resources to address.
The drop-in replacement model#
Rather than forcing organizations to choose between exception-seeking, risky backporting, or months-long version upgrades, Chainguard offers a fourth path. Teams swap vulnerable libraries for remediated versions by updating a single Maven pom.xml reference. The patched packages ship with new version identifiers (marked with a -0.cgr.N suffix), appearing clean to vulnerability scanners rather than flagging as manually patched CVE carriers—a distinction that matters for audit compliance.
Each remediated library includes an SBOM and provenance attestation. Support is already built in for Wiz, AWS Inspector, Grype, and Trivy, with additional scanner compatibility planned. The Chainguard console surfaces which CVEs are addressed in each version and links to advisory details.
Scaling security without forcing upgrades#
The approach lets teams reduce risk at their current version while completing upgrades on their own timeline, rather than being forced into rushed migrations. For organizations managing hundreds of applications across multiple teams, the ability to apply a remediated drop-in without coordinating parallel upgrades could represent meaningful risk reduction at scale.
This move extends Chainguard's supply chain security posture—built initially around hardened container images—further up the dependency stack. The company already offers remediated libraries for JavaScript and Python through its broader Chainguard Libraries catalog.
