CVE-2026-47881: CWE-400 Uncontrolled Resource Consumption in Spring Spring Batch

Spring Batch's FlatFileItemReader supports multi-line logical records, such as CSV fields containing embedded newlines. CVE-2026-47881 arises from the way this reader assembles such records, allowing a specially crafted input file to trigger excessive CPU and memory consumption. This uncontrolled resource consumption can cause batch jobs to stall or run out of memory. The vulnerability affects Spring Batch versions 4.3.0 to 4.3.13, 5.2.0 to 5.2.6, and 6.0.0 to 6.0.4. The CVSS v3.1 score is 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged confidentiality and integrity, but high impact on availability.

Exploitation of this vulnerability can cause denial of service by exhausting CPU and memory resources during batch processing. This leads to stalled batch jobs or out-of-memory errors, impacting availability of the affected systems. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, avoid processing untrusted or specially crafted multi-line CSV input files with FlatFileItemReader.