CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
Attackers can execute arbitrary code via unsafe Java deserialization in Spring Batch's default JDBC job repository serializer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47878?
CVE-2026-47878 is a medium-severity unsafe deserialization vulnerability in Spring Batch, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
Weakness: CWE-502
Which versions are affected by CVE-2026-47878?
It affects 1 product.
Products include Broadcom Spring Batch.
How do I fix CVE-2026-47878?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-47878 being exploited?
There is no known exploitation of CVE-2026-47878 in the wild and no public exploit code.
Other vulnerabilities in Spring Batch
- CVE-2019-3774 Spring Batch XML External Entity Injection (XXE)
- CVE-2020-5411 Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"
- CVE-2026-47881 Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
- CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist
Sources
Also known as CLSA-2026-1791375028, GHSA-2pwq-qhmm-3vg8.