CVE-2026-47878
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.
Risk Assessment
An attacker who can supply malicious data to the job repository can exploit deserialization to achieve arbitrary code execution in the application context.
Recommendation
Update Spring Batch to a patched version or configure an ObjectInputFilter to restrict allowed classes.
Other vulnerabilities in Spring Batch
See all- CVE-2026-47881Medium
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Affected versions: Spring Batch 6.0.0-6.0.4, 5.2.0-5.2.6, and 4.3.0-4.3.13.
- CVE-2026-47875Medium
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
Original NVD description (English source)
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier