Java and Spring face rising security threats as Broadcom tightens control with AI

Java and Spring remain critical tools for global businesses, but security challenges are growing. New data shows that 56% of Java developers face vulnerabilities in Spring on a weekly basis. Meanwhile, Broadcom is pushing AI-driven solutions to help enterprises stay ahead of threats—though not all developers are on board with its approach. Spring runs in over half of Fortune 500 companies, making it a prime target for cyber threats. With Spring Boot 4.0 now managing 1,768 dependencies, the complexity of securing applications has surged. Broadcom has responded by scaling frontier AI models to scan for vulnerabilities faster than human teams can patch them.

The company is also extending its clean-room build process across Spring’s entire dependency chain. This covers more than 100,000 validated builds, aiming to lock down risks before they reach production. For paying Tanzu Spring customers, Broadcom now offers day-zero CVE patches through its Spring Enterprise Repository.

Yet Broadcom’s control over Spring has sparked frustration among developers. Many argue that tighter restrictions limit flexibility, even as the company bets that enterprises will pay for faster, more reliable security updates. The tension comes as Java’s role in AI development grows—62% of enterprises now use it for AI coding, up from 50% last year. Broadcom’s strategy centres on speed and certainty for enterprise clients. By offering early access to CVE fixes and verified dependencies, it aims to justify its dominance in the Spring ecosystem. For developers, however, the trade-off between security and control remains a key concern.