CVE-2026-47881
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Affected versions: Spring Batch 6.0.0-6.0.4, 5.2.0-5.2.6, and 4.3.0-4.3.13.
Risk Assessment
The risk is the possibility of a DoS attack on batch jobs, which could lead to disruptions in data processing and resource exhaustion.
Recommendation
It is recommended to update Spring Batch to the latest available version and validate input files for malicious structure.
Other vulnerabilities in Spring Batch
See all- CVE-2019-3774Critical
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions are susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
- CVE-2026-47878Medium
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.
- CVE-2026-47875Medium
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
- CVE-2020-5411High
Jackson, when configured with default typing, has a deserialization vulnerability that could lead to arbitrary code execution. Spring Batch, using Jackson with global default typing, may allow code execution if an attacker has write access to the JobRepository data store.
Original NVD description (English source)
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
Vulnerability data from NVD (NIST) · CISA KEV · EPSS