CVE-2020-5411 Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"
Attackers with write access to the job repository can execute arbitrary code via unsafe Jackson deserialization in Spring Batch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-5411?
CVE-2020-5411 is a high-severity unsafe deserialization vulnerability in Spring Batch, published on 11 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.
Weakness: CWE-502
Which versions are affected by CVE-2020-5411?
2 open source packages ship an affected version, including org.springframework.batch:spring-batch-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.batch:spring-batch-core Maven | From 4.0.0 | 4.2.3 |
org.springframework.batch:spring-batch-core Maven | From 4.0.0 | 4.2.3 |
Products include Broadcom Spring Batch.
How do I fix CVE-2020-5411?
Upgrade org.springframework.batch:spring-batch-core to 4.2.3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-5411 being exploited?
There is no known exploitation of CVE-2020-5411 in the wild and no public exploit code.
Other vulnerabilities in Spring Batch
- CVE-2019-3774 Spring Batch XML External Entity Injection (XXE)
- CVE-2026-47881 Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
- CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist
- CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
Sources
Also known as GHSA-4ph4-q9r5-6wm6.