CVE-2026-47881: Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Spring Batch FlatFileItemReader with versions 6.0.0 through 6.0.4, 5.2.0 through 5.2.6, or 4.3.0 through 4.3.13 are affected when they process crafted multi-line input records.
What must an attacker be able to do to trigger the denial of service?
An attacker must be able to supply or influence an input file processed by FlatFileItemReader. The crafted file uses a logical record spanning multiple physical lines, such as a quoted CSV field containing embedded newlines.
What is the expected impact if exploitation succeeds?
Processing the malformed file can consume excessive CPU time and memory. The affected batch job may stall or terminate after running out of memory.