CVE-2026-47878
Received Received - Intake

DefaultExecutionContextSerializer Deserialization Flaw in Spring Batch

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47878
EUVD
EUVD-2026-66841

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
spring_project spring_batch From 5.2.6 (inc) to 6.0.4 (inc)
spring_project spring_batch 6.0.5
spring_project spring_batch 5.2.7
spring_project spring_batch From 6.0.0 (inc) to 6.0.4 (inc)
spring_project spring_batch to 5.2.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unsafe Java deserialization flaw in Spring Batch's DefaultExecutionContextSerializer class. It occurs because the class passes Base64-decoded bytes directly to ObjectInputStream.readObject() without restricting deserialization to trusted classes. This allows malicious objects to be deserialized, potentially leading to code execution or other attacks.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable Spring Batch versions and inspecting custom ObjectInputFilter configurations. Review logs for InvalidClassException errors during deserialization. Use commands like 'find / -name "spring-batch*.jar" 2>/dev/null' to locate Spring Batch JAR files and check their versions against the affected ranges (5.2.6 and earlier, 6.0.0-6.0.4).

Monitor application logs for deserialization failures or unexpected exceptions. Enable verbose logging for ObjectInputStream operations if possible.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on systems using affected Spring Batch versions. It may lead to data breaches, system compromise, or denial of service. Applications storing untrusted data in ExecutionContext are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Organizations must address it to maintain compliance with data protection regulations.

Mitigation Strategies

Upgrade to fixed versions: Spring Batch 6.0.5 (OSS) or 6.0.4.1 (Enterprise Support), or 5.2.7 (Enterprise Support only). If upgrading is not possible, inject a custom ObjectInputFilter via DefaultExecutionContextSerializer#setObjectInputFilter to restrict deserialization to trusted classes.

Disable or restrict access to the JDBC job repository if not required. Review ExecutionContext data for user-defined types and sanitize inputs to prevent malicious deserialization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47878. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart