CVE-2020-5411
HighCVSS 8.1Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Jackson, when configured with default typing, has a deserialization vulnerability that could lead to arbitrary code execution. Spring Batch, using Jackson with global default typing, may allow code execution if an attacker has write access to the JobRepository data store.
Risk Assessment
An attacker with access to the data store could execute arbitrary code in the application context, potentially leading to system compromise.
Recommendation
Update Spring Batch to a patched version and consider disabling Jackson's default typing if not required.
Other vulnerabilities in Spring Batch
See all- CVE-2019-3774Critical
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions are susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
- CVE-2026-47881Medium
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Affected versions: Spring Batch 6.0.0-6.0.4, 5.2.0-5.2.6, and 4.3.0-4.3.13.
- CVE-2026-47878Medium
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.
- CVE-2026-47875Medium
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
Original NVD description (English source)
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.