Deserialization Vulnerability in Spring Batch by Pivotal Software
CVE-2026-47875

5.6MEDIUM

Key Information:

Vendor

Spring

Status
Spring Batch
Vendor
CVE Published:
27 August 2026

What is CVE-2026-47875?

A deserialization vulnerability exists in applications utilizing the Jackson2ExecutionContextStringSerializer within Spring Batch. This issue arises when job repositories employ untrusted data sources, thereby allowing attackers to exploit the JobParameterDeserializer. It fails to adequately enforce the trusted-types allowlist, which opens the door for malicious input that can lead to arbitrary code execution, making systems susceptible to known Jackson RCE gadgets.

Affected Version(s)

Spring Batch 6.0.0 <= 6.0.4

Spring Batch 5.2.0 <= 5.2.6

References

https://spring.io/security/cve-2026-47875

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.