CVE-2026-47875

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47875

Spring Batch (org.springframework.batch:spring-batch-core) versions 6.0.0–6.0.4 and 5.2.0–5.2.6 are vulnerable to deserialization of untrusted data in the JobParameterDeserializer. When Jackson2ExecutionContextStringSerializer is used with an untrusted job repository data source, the deserializer...

am.ik.spring:spring-batch-migration-helper (0.2.0), com.github.ggreen:sql-task (0.0.1) +42 more potentially affected by CVE-2026-47875 via org.springframework.batch:spring-batch-core (>=6.0.0, <=6.0.4)

org.springframework.batch:spring-batch-core MAVEN version =6.0.0, =7.0.1, =1.8.0, =0.0.47, =0.0.47, =0.0.47, =1.1.0, =1.1.0, =1.1.0, =1.2.0 and more Source cves: CVE-2026-47875 Source advisory: MEND:CVE-2026-47875...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

EUVD-2026-66839

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47878: Deserialization of Untrusted Data

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

CVE-2026-47881: Uncontrolled Resource Consumption

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume...

CVE-2026-47875: Deserialization of Untrusted Data

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

PT-2026-82400

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume...

PT-2026-82397

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

PT-2026-82395

Name of the Vulnerable Software and Affected Versions Spring Batch versions 6.0.0 through 6.0.4 Spring Batch versions 5.2.0 through 5.2.6 Description Applications using Jackson2ExecutionContextStringSerializer to deserialize execution contexts are susceptible to a deserialization attack when an...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the FlatFileItemReader when handling specially crafted input files that exploit the way multi-line records are assembled. An attacker can cause excessive CPU and memory consumptio...

Deserialization of Untrusted Data

Overview org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JobParameterDeserializer. An attacker can execute arbitrary code by...

Deserialization of Untrusted Data

Overview org.springframework.batch:spring-batch-core is a framework for writing offline and batch applications using Spring and Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialize function. An attacker can execute arbitrary code or...

am.ik.spring:spring-batch-migration-helper (0.2.0), com.github.ggreen:sql-task (0.0.1) +42 more potentially affected by CVE-2026-47878 via org.springframework.batch:spring-batch-core (>=6.0.0-m1, <=6.0.4)

org.springframework.batch:spring-batch-core MAVEN version =6.0.0-m1, =7.0.1, =1.8.0, =0.0.47, =0.0.47, =0.0.47, =1.1.0, =1.1.0, =1.1.0, =1.2.0 and more Source cves: CVE-2026-47878 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKBATCH-19267918...

am.ik.spring:spring-batch-migration-helper (>=0.1.0, <=0.2.0), au.csiro.pathling:fhir-server (>=5.3.1, <=6.1.4) +437 more potentially affected by CVE-2026-47881 via org.springframework.batch:spring-batch-infrastructure (>=4.3.0, <=6.0.4)

org.springframework.batch:spring-batch-infrastructure MAVEN version =4.3.0, =0.1.0, =5.3.1, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.6.0, =3.3.0, =3.6.0, =3.6.0, =3.6.0, =3.6.0, =3.3.0, =3.6...

Spring Office Hours Podcast: S5E17 - Spring Boot 4.1 with Phil Webb

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by Spring Boot co-creator and project lead Phil Webb to dig into what's new in Spring Boot 4.1. They walk through the headline features landing in this release, including...

This Week in Spring - June 23rd, 2026

Hi Spring fans! In this installment, we look at the wide and wonderful world of Spring, as usual, and there's a good amount to get to, fresh off the recent Spring Boot 4.1 generation release train, so let's dive right into it! I wrote a blog post looking at Spring Batch, MongoDB, and Spring Boot...

This Week in Spring - June 16th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! I'm writing this from the oh-so-delightful and delicious! city of New Delhi, India. It's been a real privilege to come and visit so many amazing people. Last night my friend DaShaun and I presented here at the local Delhi JUG,...