CVE-2026-47881
Received Received - Intake

Denial of Service in Spring Batch via Malformed Multi-line Records

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47881
EUVD
EUVD-2026-66844

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
spring_project spring_batch From 4.3.0 (inc) to 4.3.13 (inc)
spring_project spring_batch From 5.2.0 (inc) to 5.2.6 (inc)
spring_project spring_batch From 6.0.0 (inc) to 6.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service vulnerability in Spring Batch's FlatFileItemReader. It occurs when processing malformed files where a single record spans multiple lines, such as CSV fields with embedded newlines in quotes. Attackers can craft files that cause the reader to use excessive CPU and memory, leading to job stalls or crashes.

Detection Guidance

Monitor CPU and memory usage during batch processing jobs. Check for jobs that stall or consume excessive resources unexpectedly. Review logs for records spanning multiple lines in CSV or similar files.

Impact Analysis

If exploited, this vulnerability can cause your Spring Batch applications to consume too much CPU and memory, leading to performance degradation, job failures, or system crashes. This disrupts normal operations and may require manual intervention to recover.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by causing system outages or degraded performance during batch processing. If a batch job stalls or crashes due to excessive resource consumption, it may disrupt data processing workflows, potentially leading to delays in handling sensitive data or violating service level agreements. However, the vulnerability itself does not directly violate these regulations.

Mitigation Strategies

Upgrade to fixed versions: Spring Batch 6.0.5, 6.0.4.1, 5.2.7, or 4.3.14. If upgrading is not possible, switch to SimpleRecordSeparatorPolicy or implement file size checks to reject oversized inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47881. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart