CVE-2026-47875

Name of the Vulnerable Software and Affected Versions Spring Batch versions 6.0.0 through 6.0.4 Spring Batch versions 5.2.0 through 5.2.6

Description Applications using Jackson2ExecutionContextStringSerializer to deserialize execution contexts are susceptible to a deserialization attack when an untrusted data source is used for the job repository. The JobParameterDeserializer function fails to properly enforce the trusted-types allowlist, enabling an attacker to provide malicious input that can result in arbitrary code execution via known Jackson RCE gadgets.

Recommendations Update Spring Batch versions 6.0.0 through 6.0.4 to a version newer than 6.0.4. Update Spring Batch versions 5.2.0 through 5.2.6 to a version newer than 5.2.6.