CVE-2019-3774
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions are susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Risk Assessment
An attacker could exploit this vulnerability to read files from the server, perform SSRF attacks, or other XML-related actions, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to immediately upgrade Spring Batch to a patched version and avoid processing untrusted XML data without proper security configuration.
Other vulnerabilities in Spring Batch
See all- CVE-2026-47881Medium
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Affected versions: Spring Batch 6.0.0-6.0.4, 5.2.0-5.2.6, and 4.3.0-4.3.13.
- CVE-2026-47878Medium
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.
- CVE-2026-47875Medium
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
- CVE-2020-5411High
Jackson, when configured with default typing, has a deserialization vulnerability that could lead to arbitrary code execution. Spring Batch, using Jackson with global default typing, may allow code execution if an attacker has write access to the JobRepository data store.
Original NVD description (English source)
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.