CVE-2026-47878
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
CVE-2026-47878- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-66841
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
EUVD-2026-66841- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2pwq-qhmm-3vg8
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes...
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
GHSA-2pwq-qhmm-3vg8- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
CVE-2026-47878- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier
- Record
CVE-2026-47878- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1791375028 No score
TuxCare security update for org.springframework.batch:spring-batch-core (1 CVE)
TuxCare rebuilt org.springframework.batch:spring-batch-core to address 1 CVE. Fixed in 5.1.3-tuxcare.4.
- Record
CLSA-2026-1791375028- Updated
- 2026-11-02
Show 13 moreShow less
OSVCLSA-2026-1791917708 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.2.6-tuxcare.3.
- Record
CLSA-2026-1791917708- Updated
- 2026-11-02
OSVCLSA-2026-1791957369 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.2.4-tuxcare.1.
- Record
CLSA-2026-1791957369- Updated
- 2026-11-02
OSVCLSA-2026-1791966597 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.1.2-tuxcare.5.
- Record
CLSA-2026-1791966597- Updated
- 2026-11-02
OSVCLSA-2026-1791966957 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.9-tuxcare.2.
- Record
CLSA-2026-1791966957- Updated
- 2026-11-02
OSVCLSA-2026-1791967177 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.3-tuxcare.2.
- Record
CLSA-2026-1791967177- Updated
- 2026-11-02
OSVCLSA-2026-1791967355 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.0.4-tuxcare.1.
- Record
CLSA-2026-1791967355- Updated
- 2026-11-02
OSVCLSA-2026-1791968492 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.8-tuxcare.2.
- Record
CLSA-2026-1791968492- Updated
- 2026-11-02
OSVCLSA-2026-1791969288 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.10-tuxcare.12.
- Record
CLSA-2026-1791969288- Updated
- 2026-11-02
OSVCLSA-2026-1791969528 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.2.4.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791969528- Updated
- 2026-11-02
OSVCLSA-2026-1791974788 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.1.2.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791974788- Updated
- 2026-11-02
OSVCLSA-2026-1791989586 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791989586- Updated
- 2026-11-02
OSVCLSA-2026-1791993578 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.2-tuxcare.1.
- Record
CLSA-2026-1791993578- Updated
- 2026-11-02
OSVCLSA-2026-1791996087 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.0.1.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791996087- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.1.3 up to 5.1.3-tuxcare.4, plus listed versions 5.1.3-tuxcare.15.1.3-tuxcare.25.1.3-tuxcare.3 |
5.1.3-tuxcare.4 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.2.6 up to 5.2.6-tuxcare.3, plus listed versions 5.2.6-tuxcare.15.2.6-tuxcare.2 |
5.2.6-tuxcare.3 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.2.6 up to 5.2.6-tuxcare.3, plus listed versions 5.2.6-tuxcare.15.2.6-tuxcare.2 |
5.2.6-tuxcare.3 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.1.2 up to 5.1.2-tuxcare.5, plus listed versions 5.1.2-tuxcare.15.1.2-tuxcare.25.1.2-tuxcare.35.1.2-tuxcare.4 |
5.1.2-tuxcare.5 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.1.2 up to 5.1.2-tuxcare.5, plus listed versions 5.1.2-tuxcare.15.1.2-tuxcare.25.1.2-tuxcare.35.1.2-tuxcare.4 |
5.1.2-tuxcare.5 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
4.3.9 up to 4.3.9-tuxcare.2, plus listed versions 4.3.9-tuxcare.1 |
4.3.9-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
4.3.9 up to 4.3.9-tuxcare.2, plus listed versions 4.3.9-tuxcare.1 |
4.3.9-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
4.3.3 up to 4.3.3-tuxcare.2, plus listed versions 4.3.3-tuxcare.1 |
4.3.3-tuxcare.2 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
4.3.3 up to 4.3.3-tuxcare.2, plus listed versions 4.3.3-tuxcare.1 |
4.3.3-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
5.0.4 up to 5.0.4-tuxcare.1 | 5.0.4-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
5.0.4 up to 5.0.4-tuxcare.1 | 5.0.4-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
4.3.8 up to 4.3.8-tuxcare.2, plus listed versions 4.3.8-tuxcare.1 |
4.3.8-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
4.3.8 up to 4.3.8-tuxcare.2, plus listed versions 4.3.8-tuxcare.1 |
4.3.8-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
4.3.10 up to 4.3.10-tuxcare.12, plus listed versions 4.3.10-tuxcare.104.3.10-tuxcare.114.3.10-tuxcare.24.3.10-tuxcare.34.3.10-tuxcare.4 Show 7 moreShow less4.3.10-tuxcare.54.3.10-tuxcare.64.3.10-tuxcare.74.3.10-tuxcare.84.3.10-tuxcare.94.3.10.tuxcare4.3.10.tuxcare.1 |
4.3.10-tuxcare.12 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
4.3.10 up to 4.3.10-tuxcare.12, plus listed versions 4.3.10-tuxcare.104.3.10-tuxcare.114.3.10-tuxcare.24.3.10-tuxcare.34.3.10-tuxcare.4 Show 7 moreShow less4.3.10-tuxcare.54.3.10-tuxcare.64.3.10-tuxcare.74.3.10-tuxcare.84.3.10-tuxcare.94.3.10.tuxcare4.3.10.tuxcare.1 |
4.3.10-tuxcare.12 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
4.2.4.RELEASE up to 4.2.4.RELEASE-tuxcare.1 | 4.2.4.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
4.2.4.RELEASE up to 4.2.4.RELEASE-tuxcare.1 | 4.2.4.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
4.1.2.RELEASE up to 4.1.2.RELEASE-tuxcare.1 | 4.1.2.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
4.1.2.RELEASE up to 4.1.2.RELEASE-tuxcare.1 | 4.1.2.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.2, plus listed versions 3.0.10.RELEASE-tuxcare.1 |
3.0.10.RELEASE-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.2, plus listed versions 3.0.10.RELEASE-tuxcare.1 |
3.0.10.RELEASE-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
4.3.2 up to 4.3.2-tuxcare.1 | 4.3.2-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
4.3.2 up to 4.3.2-tuxcare.1 | 4.3.2-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven |
4.0.1.RELEASE up to 4.0.1.RELEASE-tuxcare.1 | 4.0.1.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven |
4.0.1.RELEASE up to 4.0.1.RELEASE-tuxcare.1 | 4.0.1.RELEASE-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, products, published | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47878 is a medium vulnerability (CVSS 5.6) in Broadcom Spring Batch, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in org.springframework.batch:spring-batch-core 5.1.3-tuxcare.4.