New Broadcom Enhancements to TrueSource Spring Enterprise with Hub and App Advisor Help Customers Assess their Open Source Security Posture, Prioritize Fixes, and Automate Patching

Early-access and critical infrastructure customers receive security fixes ahead of public vulnerability disclosure.

Rhea-AI Summary

Broadcom (AVGO) shipped fixes for 89 newly identified vulnerabilities in TrueSource Spring Enterprise to critical infrastructure and other qualifying early-access customers. This brings vulnerabilities fixed across TrueSource offerings to 408 in 2026. Public vulnerability details will follow when fixes reach the community and CVE identifiers are issued.

TrueSource Spring Enterprise is now generally available with TrueSource Hub and build plugins. Hub tracks application exposure and patch status, while Application Advisor plugins generate update pull requests within Maven and Gradle workflows. Fixes are delivered simultaneously across supported versions, including legacy releases.

Argus 15 min delay 29 alerts

+3.44% vs previous close $340.50 last price 1.7x rel. volume Open Argus

Details

Market Reaction – AVGO

$328.48 – $345.67 Day Range

$1.63T Mkt Cap at Last Price

On Oct 27, the day this news came out, the latest delayed price for AVGO is 3.44% above the previous close. Our momentum scanner has recorded 29 alerts for this stock so far that day. The latest delayed price is $340.50. Relative volume is above average at 1.7x the average.

Data tracked by StockTitan Argus (15 min delayed). Upgrade to Gold for real-time data.

Key Figures

New vulnerabilities fixed: 89 Total vulnerabilities fixed: 408 Fixes accessible immediately: 87 +2 more

New vulnerabilities fixed

89

TrueSource Spring Enterprise fixes shipped to early-access and critical-infrastructure customers

Total vulnerabilities fixed

408

Across TrueSource offerings in 2026

Fixes accessible immediately

87

For early-access and critical-infrastructure customers

Fixes delivered

over 1,090

2026 open-source security impact

Backports

798

Included among fixes delivered in 2026

Key Terms

cvss, remote code execution, backports

3 terms

cvss technical

"CVSS 8.1"

Common Vulnerability Scoring System (CVSS) is a standardized way to rate the severity of software security flaws on a numeric scale, summarizing how easily a vulnerability can be exploited and how much damage it could cause. For investors, CVSS scores act like a storm severity chart for a company’s digital systems — higher scores signal greater operational, financial and reputational risk, possibly leading to remediation costs, downtime, or regulatory scrutiny that can affect a firm’s value.

remote code execution technical

"Fixed a remote code execution vulnerability"

Remote code execution is a security flaw that allows an attacker to run their own software on a company's computer or server over a network, like an intruder entering a building and using its equipment. It matters to investors because a successful exploit can disrupt operations, expose sensitive data, trigger regulatory penalties and expensive fixes, and damage reputation — all of which can hurt revenue and share value.

backports technical

"delivered over 1,090 fixes (including 798 backports)"

Changes, fixes, or features originally developed for a newer version of software that are adapted and applied to an older, still-supported version so that that older release benefits from the newer code without requiring a full upgrade. Backports typically involve rewriting or testing the newer code to fit the older version’s architecture and dependencies and are used to deliver security patches, bug fixes, or selected features while preserving backward compatibility.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Broadcom Fixes 89 New Open Source Vulnerabilities in TrueSource Spring Enterprise, Reaching 408 Total in 2026

PALO ALTO, Calif., Oct. 27, 2026 (GLOBE NEWSWIRE) -- Broadcom Inc. (NASDAQ: AVGO), a global technology leader that designs, develops, and supplies semiconductor and infrastructure software solutions, today shipped fixes for 89 novel vulnerabilities in TrueSource Spring Enterprise to its critical infrastructure customers and others who qualify for early access, ahead of public disclosure. This brings the total number of vulnerabilities fixed across TrueSource offerings to 408.

Patches only secure an environment once deployed. To close that gap, Spring Enterprise adds TrueSource Hub to help enterprises assess application exposure, prioritize critical fixes, and track status. Additionally, build plugins for Application Advisor automate patching within existing Maven or Gradle workflows, generating update pull requests to streamline merging approved fixes.

A sustained investment in open source security

Building on its June 2026 open source commitment, Broadcom uses Frontier AI scanning and advanced research to find and fix vulnerabilities. TrueSource Spring Enterprise delivers simultaneous fixes across all supported versions, giving legacy releases immediate access, while providing security-only patches for current versions to speed deployment. Detailed vulnerability information will be published when fixes reach the community and CVEs are issued.

Scale & Impact: Reaching a massive footprint of downloads of Spring and Reactor libraries in 2026, Broadcom engineers fixed 406 new vulnerabilities, delivered over 1,090 fixes (including 798 backports), reviewed 2,600+ reports, and filtered out 3,000+ false alarms.

Key High/Critical Broadcom Fixes Earlier This Year:

• Spring (June): Fixed a remote code execution vulnerability (CVE-2026-41855, CVSS 8.1) across four supported lines simultaneously.
• Netty Dependency (June): Discovered a DNS redirection vulnerability (CVE-2026-47691, CVSS 10.0) and addressed with the community maintainers and fixed for all supported Spring versions.
• RabbitMQ (July): Fixed a credential forgery vulnerability (CVE-2026-67404, CVSS 9.2) across four supported lines at once.
  
  

“Security isn’t a one-time initiative; it’s an ongoing commitment. In June, we pledged to identify and resolve Spring vulnerabilities faster than ever, and today’s release demonstrates our continued momentum,” said Purnima Padmanabhan, general manager, Tanzu Division, Broadcom. “Our customers receive critical fixes early in a deployable format, with complete visibility into where patches belong and confirmation when they land. Crucially, fixes are contributed back to the open source community—because open source remains resilient only when businesses actively invest in ecosystem health.”

See it, prioritize it, fix it, prove it

Most enterprises know they run open source. Few can say exactly which applications run which versions, which are out of support, and which need a fix published this morning. TrueSource Spring Enterprise closes that gap with four capabilities that work together:

• Assess every repository. TrueSource Hub connects to an organization’s code repositories and shows the security state of the open source components every application depends on, across Java, Python, and JavaScript libraries, container images, and data services, along with its patch status, in a live view rather than a one-time audit.
• Prioritize the fixes that matter. When Broadcom publishes a fix, Hub shows which applications need it and how exposed they are, so security and engineering leaders can direct effort to the applications that carry the most risk. TrueSource works with the vulnerability scanners that teams already use. Snyk, for example, is actively partnering with Broadcom so that customers can recognize Broadcom-patched Spring versions as fixed, with the goal of reducing unnecessary alerts and keeping teams from chasing alerts for already-resolved vulnerabilities.
• Apply patches in the build. For Spring applications, Spring Application Advisor plugins integrate directly into existing Maven and Gradle builds. Fixes and version upgrades arrive as reviewable pull requests built on deterministic recipes verified by TrueSource engineers. Additionally, the new integration with JFrog Zero-Touch Remediation delivers instant protection. By automatically delivering verified, backward-compatible TrueSource fixes to builds, security teams can stop waiting on manual pull requests and dependency overrides - keeping software secure with zero friction.
• Prove it through pipeline audits. Every build records its source and the libraries it contains and reports that to TrueSource, so security leaders can show their boards and leadership exactly which libraries shipped and where each fix was applied.

The TrueSource portfolio

TrueSource by Broadcom is Broadcom’s portfolio of enterprise open source software, verified by engineers and delivered from one trusted source. It has three offerings:

• TrueSource Spring Enterprise for the Spring framework Broadcom maintains, with CVE-only patches, the security fix and nothing else, delivered for every supported version at the same time so teams can apply them without an upgrade, plus the tooling announced today.
• TrueSource Trusted Artifacts for verified open source libraries in Java, Python, and JavaScript, and the Secure Images catalog of container images, covering the middleware, runtimes, and backing services applications depend on.
• TrueSource Data Services for the data engines applications rely on: PostgreSQL, MySQL, Valkey, and RabbitMQ, with self-service provisioning, fleet management across environments, and enterprise support for the engines themselves, including prescribed high availability and disaster recovery.
  
  

Availability

TrueSource Spring Enterprise, featuring TrueSource Hub and build plugins, is generally available today. Its 87 fixes are accessible immediately to early-access and critical infrastructure customers, with public CVE release to follow. TrueSource Spring Enterprise, Trusted Artifacts, and Data Services are offered via tiered site licensing. Learn more at https://www.broadcom.com/products/software/truesource.

About Broadcom

Broadcom Inc. (NASDAQ: AVGO) is a technology leader that designs, develops, and supplies semiconductors and infrastructure software for global organizations’ complex, mission-critical needs. Broadcom combines long-term R&D investment with superb execution to deliver the best technology, at scale. Broadcom is a Delaware corporation headquartered in Palo Alto, CA. For more information, visit www.broadcom.com.

Broadcom and the pulse logo are among the trademarks of Broadcom. Postgres and PostgreSQL are registered trademarks of the PostgreSQL Community Association of Canada. MySQL is a registered trademark of Oracle Corporation. Valkey is a trademark of The Linux Foundation. All other trademarks are the property of their respective owners. Broadcom is not affiliated with, endorsed by, or sponsored by any of the foregoing organizations.

Media contact

John D’Avolio

Tanzu Division, Broadcom

+1.503.308.3096

john.davolio@broadcom.com

FAQ

AI-generated questions and answers. How Rhea-AI works. Not financial advice.

What is included in Broadcom's TrueSource Spring Enterprise update?

The update adds TrueSource Hub and build plugins, now generally available with TrueSource Spring Enterprise. Hub tracks application exposure and patch status, while Application Advisor plugins generate reviewable update pull requests within existing Maven and Gradle builds.

Who can access Broadcom's latest TrueSource Spring Enterprise security fixes?

Critical infrastructure customers and other qualifying early-access customers receive the fixes before public disclosure. Detailed vulnerability information will be published when fixes reach the community and CVE identifiers are issued.