CVE-2026-47881

Analyzed Analyzed - Analysis Complete

Denial of Service in Spring Batch via Malformed Multi-line Records

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47881

EUVD

EUVD-2026-66844

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	spring_batch	From 4.3.0 (inc) to 4.3.14 (exc)
broadcom	spring_batch	From 5.2.0 (inc) to 5.2.7 (exc)
broadcom	spring_batch	From 6.0.0 (inc) to 6.0.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a Denial of Service vulnerability in Spring Batch's FlatFileItemReader. It occurs when processing malformed files where a single record spans multiple lines, such as CSV fields with embedded newlines in quotes. Attackers can craft files that cause the reader to use excessive CPU and memory, leading to job stalls or crashes.

Detection Guidance

Monitor CPU and memory usage during batch processing jobs. Check for jobs that stall or consume excessive resources unexpectedly. Review logs for records spanning multiple lines in CSV or similar files.

Impact Analysis

If exploited, this vulnerability can cause your Spring Batch applications to consume too much CPU and memory, leading to performance degradation, job failures, or system crashes. This disrupts normal operations and may require manual intervention to recover.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by causing system outages or degraded performance during batch processing. If a batch job stalls or crashes due to excessive resource consumption, it may disrupt data processing workflows, potentially leading to delays in handling sensitive data or violating service level agreements. However, the vulnerability itself does not directly violate these regulations.

Mitigation Strategies

Upgrade to fixed versions: Spring Batch 6.0.5, 6.0.4.1, 5.2.7, or 4.3.14. If upgrading is not possible, switch to SimpleRecordSeparatorPolicy or implement file size checks to reject oversized inputs.

Hi! I’m here to help you understand CVE-2026-47881. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70