Deserialization Vulnerability in Spring Batch by Pivotal Software
CVE-2026-47878

5.6MEDIUM

Key Information:

Vendor

Spring

Status
Spring Batch
Vendor
CVE Published:
27 August 2026

What is CVE-2026-47878?

A deserialization vulnerability exists in Spring Batch's JDBC job repository due to the DefaultExecutionContextSerializer. This vulnerability arises from the direct passing of Base64-decoded bytes to ObjectInputStream.readObject() without implementing an ObjectInputFilter to restrict types to a trusted class allowlist. As a result, untrusted data could potentially lead to execution of arbitrary code or other security issues.

Affected Version(s)

Spring Batch 6.0.0 <= 6.0.4

Spring Batch 0 <= 5.2.6

References

https://spring.io/security/cve-2026-47878

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.