A Spring Boot fat-jar is a self-contained Java application archive that bundles the application code and its runtime dependencies into one executable file. Instead of relying on libraries installed separately on the server, the service ships with everything it needs to start, including frameworks, parsers, and helper classes.
This packaging model is convenient for deployment, but it also changes security operations. If a vulnerable library is bundled inside the fat-jar, the weakness travels with the application and must be fixed by rebuilding and redeploying the artifact. In attacks, this matters because an attacker who reaches a vulnerable component inside the archive may exploit it directly through the running Java process. Defenders should inventory fat-jars, identify embedded dependency versions, and scan them for risky libraries or unsafe parser settings before they are exposed to untrusted input.