CVE-2026-47878: CWE-502 Deserialization of Untrusted Data in Spring Spring Batch

The vulnerability in Spring Batch's DefaultExecutionContextSerializer allows deserialization of untrusted data because it does not use an ObjectInputFilter to restrict the classes that can be deserialized. This occurs in the JDBC job repository component where Base64-decoded bytes are passed directly to ObjectInputStream.readObject(). Affected versions include Spring Batch 6.0.0 through 6.0.4 and 5.2.6 and earlier. The CVSS 3.1 base score is 5.6, indicating medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to cause partial loss of confidentiality, integrity, and availability by deserializing malicious objects. However, the attack complexity is high and no known exploits are reported in the wild. The vulnerability could potentially be leveraged remotely without authentication.

No official fix or patch is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing custom ObjectInputFilters to restrict deserialization to trusted classes or avoid using the DefaultExecutionContextSerializer with untrusted data.