Deserialization RCE

Spring Batch is vulnerable to deserialization RCE. The vulnerability is due to the JobParameterDeserializer not properly enforcing the trusted-types allowlist, where applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer from an untrusted job repository can...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47875

Spring Batch (org.springframework.batch:spring-batch-core) versions 6.0.0–6.0.4 and 5.2.0–5.2.6 are vulnerable to deserialization of untrusted data in the JobParameterDeserializer. When Jackson2ExecutionContextStringSerializer is used with an untrusted job repository data source, the deserializer...

PT-2026-82395

Name of the Vulnerable Software and Affected Versions Spring Batch versions 6.0.0 through 6.0.4 Spring Batch versions 5.2.0 through 5.2.6 Description Applications using Jackson2ExecutionContextStringSerializer to deserialize execution contexts are susceptible to a deserialization attack when an...

cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist

cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist...

Deserialization of Untrusted Data

Overview org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JobParameterDeserializer. An attacker can execute arbitrary code by...