CVE-2026-47878 Security Details

CVE ID

CVE-2026-47878

CWE

CWE-502

CVE Description

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier

Published

Aug 21, 2026

CVSS Score & Severity

7.3High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Score

0.352%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/batch/core/repository/dao/DefaultExecutionContextSerializer.deserialize(Ljava/io/InputStream;)Ljava/util/Map;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT