CVE-2026-47881 Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
Attackers can cause denial of service in Spring Batch applications by providing specially crafted input files that exhaust CPU and memory resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47881?
CVE-2026-47881 is a medium-severity denial of service vulnerability in Spring Batch, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
Weakness: CWE-400
Which versions are affected by CVE-2026-47881?
It affects 1 product.
Products include Broadcom Spring Batch.
How do I fix CVE-2026-47881?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-47881 being exploited?
There is no known exploitation of CVE-2026-47881 in the wild and no public exploit code.
Other vulnerabilities in Spring Batch
- CVE-2019-3774 Spring Batch XML External Entity Injection (XXE)
- CVE-2020-5411 Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"
- CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist
- CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
Sources
Also known as GHSA-jv7x-jjj5-pqwg.