CVE-2026-47875: CWE-502 Deserialization of Untrusted Data in Spring Spring Batch

Spring Batch versions 5.2.0 to 5.2.6 and 6.0.0 to 6.0.4 are vulnerable to a deserialization attack due to improper enforcement of a trusted-types allowlist in the JobParameterDeserializer component when deserializing execution contexts with Jackson2ExecutionContextStringSerializer. If the job repository uses untrusted data sources, attackers can craft malicious input that triggers arbitrary code execution leveraging known Jackson remote code execution gadgets. The vulnerability is tracked as CWE-502 (Deserialization of Untrusted Data) and has a CVSS 3.1 base score of 5.6, indicating medium severity. No official patch or remediation level is currently documented.

Successful exploitation can lead to arbitrary code execution on affected systems, potentially compromising confidentiality, integrity, and availability of the application. The attack requires network access and has a high attack complexity with no privileges or user interaction needed. However, the impact is limited to the affected Spring Batch versions and scenarios where untrusted data is deserialized.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted data sources for the job repository or disable deserialization features that use Jackson2ExecutionContextStringSerializer. Monitor vendor communications for updates and apply patches promptly once released.