CVE-2026-47878: Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Deployments using Spring Batch's JDBC job repository are exposed because DefaultExecutionContextSerializer is used by default there. The affected ranges are Spring Batch 6.0.0 through 6.0.4 and 5.2.6 and earlier.
What does an attacker need to exploit this issue?
An attacker must be able to cause attacker-controlled serialized bytes to reach the JDBC job repository's execution-context deserialization path. Exploitation does not require authentication or user interaction, but the listed attack complexity is high.
What can be done if upgrading is not immediately possible?
Use a serializer or deserialization configuration that restricts permitted object types with a trusted class allowlist or ObjectInputFilter. The vulnerable behavior is the unrestricted use of ObjectInputStream.readObject() on Base64-decoded data.