Skip to content
OpenAdvisories

Product · Spring

Spring Batch

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-47881

    Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File

    Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assemble…

    Spring Spring Batch
  • Medium 5.6
    CVE-2026-47878

    Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

    DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0…

    Spring Spring Batch
  • Medium 5.6
    CVE-2026-47875

    JobParameterDeserializer bypasses the trusted-type allowlist

    Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the t…

    Spring Spring Batch