CVE-2026-47878 — Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

CVE-2026-47878

Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist PUBLISHED

Description (CNA)

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring Batch	affected 6.0.0 through 6.0.4; affected 0 through 5.2.6

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47878

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.