CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist
Attackers can achieve arbitrary code execution by exploiting a deserialization flaw in Spring Batch when using untrusted job repository data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47875?
CVE-2026-47875 is a medium-severity unsafe deserialization vulnerability in Spring Batch, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6
Weakness: CWE-502
Which versions are affected by CVE-2026-47875?
It affects 1 product.
Products include Broadcom Spring Batch.
How do I fix CVE-2026-47875?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-47875 being exploited?
There is no known exploitation of CVE-2026-47875 in the wild and no public exploit code.
Other vulnerabilities in Spring Batch
- CVE-2019-3774 Spring Batch XML External Entity Injection (XXE)
- CVE-2020-5411 Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"
- CVE-2026-47881 Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
- CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
Sources
Also known as GHSA-mvcx-qg6f-j67g.