CVE-2026-47878

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47878
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47878.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47878
Downstream
CLSA (14)
Published
2026-08-27T05:20:23Z
Modified
2026-10-21T02:58:16Z
Severity
  • 5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
Details

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier

Database specific 
{
    "cna_assigner":  "vmware",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47878.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "6.0.0"
                        },
                        {
                            "last_affected":  "6.0.4"
                        },
                        {
                            "last_affected":  "5.2.6"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-batch

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-batch
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
39c91c1c47eb752a5e64eb612c5e411c5e7f86d8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "5.2.6"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

2.*
2.2.0.M1
2.2.0.RC1
2.2.0.RC2
2.2.0.RELEASE
3.*
3.0.0.M1
3.0.0.M2
3.0.0.M3
4.*
4.1.0.M2
4.1.0.M3
4.1.0.RC1
4.1.0.RELEASE
4.2.0.M1
4.2.0.M2
4.2.0.M3
4.2.0.RC1
4.2.0.RELEASE
4.3.0
4.3.0-M1
4.3.0-M2
4.3.0-RC1
5.*
5.0.0-M1
5.0.0-M2
5.0.0-M3
5.0.0-M4
5.0.0-M5
5.0.0-M6
5.0.0-M7
5.0.0-M8
5.0.0-RC1
5.0.0-RC2
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.1.0
v5.1.0-M1
v5.1.0-M2
v5.1.0-M3
v5.1.0-RC1
v5.2.0
v5.2.0-M1
v5.2.0-M2
v5.2.0-RC1
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v5.2.5
v5.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47878.json"