CVE-2026-47878
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
CVE-2026-47878- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-66841
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
EUVD-2026-66841- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2pwq-qhmm-3vg8
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes...
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
GHSA-2pwq-qhmm-3vg8- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
CVE-2026-47878- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
CVE-2026-47878- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1791375028No score
TuxCare security update for org.springframework.batch:spring-batch-core (1 CVE)
TuxCare rebuilt org.springframework.batch:spring-batch-core to address 1 CVE. Fixed in 5.1.3-tuxcare.4.
- Record
CLSA-2026-1791375028- Updated
- 2026-11-02
Show 13 moreShow less
OSVCLSA-2026-1791917708No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.2.6-tuxcare.3.
- Record
CLSA-2026-1791917708- Updated
- 2026-11-02
OSVCLSA-2026-1791957369No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.2.4-tuxcare.1.
- Record
CLSA-2026-1791957369- Updated
- 2026-11-02
OSVCLSA-2026-1791966597No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.1.2-tuxcare.5.
- Record
CLSA-2026-1791966597- Updated
- 2026-11-02
OSVCLSA-2026-1791966957No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.9-tuxcare.2.
- Record
CLSA-2026-1791966957- Updated
- 2026-11-02
OSVCLSA-2026-1791967177No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.3-tuxcare.2.
- Record
CLSA-2026-1791967177- Updated
- 2026-11-02
OSVCLSA-2026-1791967355No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.0.4-tuxcare.1.
- Record
CLSA-2026-1791967355- Updated
- 2026-11-02
OSVCLSA-2026-1791968492No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.8-tuxcare.2.
- Record
CLSA-2026-1791968492- Updated
- 2026-11-02
OSVCLSA-2026-1791969288No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.10-tuxcare.12.
- Record
CLSA-2026-1791969288- Updated
- 2026-11-02
OSVCLSA-2026-1791969528No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.2.4.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791969528- Updated
- 2026-11-02
OSVCLSA-2026-1791974788No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.1.2.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791974788- Updated
- 2026-11-02
OSVCLSA-2026-1791989586No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791989586- Updated
- 2026-11-02
OSVCLSA-2026-1791993578No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.2-tuxcare.1.
- Record
CLSA-2026-1791993578- Updated
- 2026-11-02
OSVCLSA-2026-1791996087No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.0.1.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791996087- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.batch:spring-batch-coreTuxCare:Maven | 5.1.3 up to 5.1.3-tuxcare.4, plus listed versions 5.1.3-tuxcare.15.1.3-tuxcare.25.1.3-tuxcare.3 | 5.1.3-tuxcare.4 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 3 CVEs | 5.2.6 up to 5.2.6-tuxcare.3, plus listed versions 5.2.6-tuxcare.15.2.6-tuxcare.2 | 5.2.6-tuxcare.3 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 3 CVEs | 5.2.6 up to 5.2.6-tuxcare.3, plus listed versions 5.2.6-tuxcare.15.2.6-tuxcare.2 | 5.2.6-tuxcare.3 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 3 CVEs | 5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 3 CVEs | 5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 3 CVEs | 5.1.2 up to 5.1.2-tuxcare.5, plus listed versions 5.1.2-tuxcare.15.1.2-tuxcare.25.1.2-tuxcare.35.1.2-tuxcare.4 | 5.1.2-tuxcare.5 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 3 CVEs | 5.1.2 up to 5.1.2-tuxcare.5, plus listed versions 5.1.2-tuxcare.15.1.2-tuxcare.25.1.2-tuxcare.35.1.2-tuxcare.4 | 5.1.2-tuxcare.5 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.3.9 up to 4.3.9-tuxcare.2, plus listed versions 4.3.9-tuxcare.1 | 4.3.9-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 4.3.9 up to 4.3.9-tuxcare.2, plus listed versions 4.3.9-tuxcare.1 | 4.3.9-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.3.3 up to 4.3.3-tuxcare.2, plus listed versions 4.3.3-tuxcare.1 | 4.3.3-tuxcare.2 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 4.3.3 up to 4.3.3-tuxcare.2, plus listed versions 4.3.3-tuxcare.1 | 4.3.3-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 3 CVEs | 5.0.4 up to 5.0.4-tuxcare.1 | 5.0.4-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 3 CVEs | 5.0.4 up to 5.0.4-tuxcare.1 | 5.0.4-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.3.8 up to 4.3.8-tuxcare.2, plus listed versions 4.3.8-tuxcare.1 | 4.3.8-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 4.3.8 up to 4.3.8-tuxcare.2, plus listed versions 4.3.8-tuxcare.1 | 4.3.8-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.3.10 up to 4.3.10-tuxcare.12, plus listed versions 4.3.10-tuxcare.104.3.10-tuxcare.114.3.10-tuxcare.24.3.10-tuxcare.34.3.10-tuxcare.4 Show 7 moreShow less4.3.10-tuxcare.54.3.10-tuxcare.64.3.10-tuxcare.74.3.10-tuxcare.84.3.10-tuxcare.94.3.10.tuxcare4.3.10.tuxcare.1 | 4.3.10-tuxcare.12 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 4.3.10 up to 4.3.10-tuxcare.12, plus listed versions 4.3.10-tuxcare.104.3.10-tuxcare.114.3.10-tuxcare.24.3.10-tuxcare.34.3.10-tuxcare.4 Show 7 moreShow less4.3.10-tuxcare.54.3.10-tuxcare.64.3.10-tuxcare.74.3.10-tuxcare.84.3.10-tuxcare.94.3.10.tuxcare4.3.10.tuxcare.1 | 4.3.10-tuxcare.12 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.2.4.RELEASE up to 4.2.4.RELEASE-tuxcare.1 | 4.2.4.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 4.2.4.RELEASE up to 4.2.4.RELEASE-tuxcare.1 | 4.2.4.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.1.2.RELEASE up to 4.1.2.RELEASE-tuxcare.1 | 4.1.2.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 4.1.2.RELEASE up to 4.1.2.RELEASE-tuxcare.1 | 4.1.2.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.2, plus listed versions 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.2, plus listed versions 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.3.2 up to 4.3.2-tuxcare.1 | 4.3.2-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 4.3.2 up to 4.3.2-tuxcare.1 | 4.3.2-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs | 4.0.1.RELEASE up to 4.0.1.RELEASE-tuxcare.1 | 4.0.1.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs | 4.0.1.RELEASE up to 4.0.1.RELEASE-tuxcare.1 | 4.0.1.RELEASE-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, products, published | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47878 is a medium vulnerability (CVSS 5.6) in Broadcom Spring Batch, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in org.springframework.batch:spring-batch-core 5.1.3-tuxcare.4.