CVE-2026-47878

Analyzed Analyzed - Analysis Complete

DefaultExecutionContextSerializer Deserialization Flaw in Spring Batch

Publication date: 2026-08-27

Last updated on: 2026-09-10

Assigner: VMware

Description

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-10

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47878

EUVD

EUVD-2026-66841

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	spring_batch	From 6.0.0 (inc) to 6.0.4.1 (exc)
broadcom	spring_batch	From 5.0.0 (inc) to 5.2.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an unsafe Java deserialization flaw in Spring Batch's DefaultExecutionContextSerializer class. It occurs because the class passes Base64-decoded bytes directly to ObjectInputStream.readObject() without restricting deserialization to trusted classes. This allows malicious objects to be deserialized, potentially leading to code execution or other attacks.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable Spring Batch versions and inspecting custom ObjectInputFilter configurations. Review logs for InvalidClassException errors during deserialization. Use commands like 'find / -name "spring-batch*.jar" 2>/dev/null' to locate Spring Batch JAR files and check their versions against the affected ranges (5.2.6 and earlier, 6.0.0-6.0.4).

Monitor application logs for deserialization failures or unexpected exceptions. Enable verbose logging for ObjectInputStream operations if possible.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on systems using affected Spring Batch versions. It may lead to data breaches, system compromise, or denial of service. Applications storing untrusted data in ExecutionContext are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Organizations must address it to maintain compliance with data protection regulations.

Mitigation Strategies

Upgrade to fixed versions: Spring Batch 6.0.5 (OSS) or 6.0.4.1 (Enterprise Support), or 5.2.7 (Enterprise Support only). If upgrading is not possible, inject a custom ObjectInputFilter via DefaultExecutionContextSerializer#setObjectInputFilter to restrict deserialization to trusted classes.

Disable or restrict access to the JDBC job repository if not required. Review ExecutionContext data for user-defined types and sanitize inputs to prevent malicious deserialization.

Hi! I’m here to help you understand CVE-2026-47878. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70