CVE-2026-47881
Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
- Record
CVE-2026-47881- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-66844
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
- Record
EUVD-2026-66844- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jv7x-jjj5-pqwg
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple...
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
- Record
GHSA-jv7x-jjj5-pqwg- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
- Record
CVE-2026-47881- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1791917708 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.2.6-tuxcare.3.
- Record
CLSA-2026-1791917708- Updated
- 2026-11-02
OSVCLSA-2026-1791954798 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 5.1.3-tuxcare.6.
- Record
CLSA-2026-1791954798- Updated
- 2026-11-02
Show 12 moreShow less
OSVCLSA-2026-1791957369 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.2.4-tuxcare.1.
- Record
CLSA-2026-1791957369- Updated
- 2026-11-02
OSVCLSA-2026-1791966597 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.1.2-tuxcare.5.
- Record
CLSA-2026-1791966597- Updated
- 2026-11-02
OSVCLSA-2026-1791966957 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.9-tuxcare.2.
- Record
CLSA-2026-1791966957- Updated
- 2026-11-02
OSVCLSA-2026-1791967177 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.3-tuxcare.2.
- Record
CLSA-2026-1791967177- Updated
- 2026-11-02
OSVCLSA-2026-1791967355 No score
TuxCare security update for org.springframework.batch (3 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 3 CVEs. Fixed in 5.0.4-tuxcare.1.
- Record
CLSA-2026-1791967355- Updated
- 2026-11-02
OSVCLSA-2026-1791968492 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.8-tuxcare.2.
- Record
CLSA-2026-1791968492- Updated
- 2026-11-02
OSVCLSA-2026-1791969288 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.10-tuxcare.12.
- Record
CLSA-2026-1791969288- Updated
- 2026-11-02
OSVCLSA-2026-1791969528 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.2.4.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791969528- Updated
- 2026-11-02
OSVCLSA-2026-1791974788 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.1.2.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791974788- Updated
- 2026-11-02
OSVCLSA-2026-1791989586 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791989586- Updated
- 2026-11-02
OSVCLSA-2026-1791993578 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.3.2-tuxcare.1.
- Record
CLSA-2026-1791993578- Updated
- 2026-11-02
OSVCLSA-2026-1791996087 No score
TuxCare security update for org.springframework.batch (2 CVEs)
TuxCare rebuilt 2 org.springframework.batch packages to address 2 CVEs. Fixed in 4.0.1.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791996087- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.2.6 up to 5.2.6-tuxcare.3, plus listed versions 5.2.6-tuxcare.15.2.6-tuxcare.2 |
5.2.6-tuxcare.3 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 3 CVEs |
5.2.6 up to 5.2.6-tuxcare.3, plus listed versions 5.2.6-tuxcare.15.2.6-tuxcare.2 |
5.2.6-tuxcare.3 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
5.1.3 up to 5.1.3-tuxcare.6, plus listed versions 5.1.3-tuxcare.15.1.3-tuxcare.25.1.3-tuxcare.35.1.3-tuxcare.45.1.3-tuxcare.5 |
5.1.3-tuxcare.6 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
5.1.3 up to 5.1.3-tuxcare.6, plus listed versions 5.1.3-tuxcare.15.1.3-tuxcare.25.1.3-tuxcare.35.1.3-tuxcare.45.1.3-tuxcare.5 |
5.1.3-tuxcare.6 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 3 CVEs |
5.2.4 up to 5.2.4-tuxcare.1 | 5.2.4-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.1.2 up to 5.1.2-tuxcare.5, plus listed versions 5.1.2-tuxcare.15.1.2-tuxcare.25.1.2-tuxcare.35.1.2-tuxcare.4 |
5.1.2-tuxcare.5 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 3 CVEs |
5.1.2 up to 5.1.2-tuxcare.5, plus listed versions 5.1.2-tuxcare.15.1.2-tuxcare.25.1.2-tuxcare.35.1.2-tuxcare.4 |
5.1.2-tuxcare.5 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.3.9 up to 4.3.9-tuxcare.2, plus listed versions 4.3.9-tuxcare.1 |
4.3.9-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
4.3.9 up to 4.3.9-tuxcare.2, plus listed versions 4.3.9-tuxcare.1 |
4.3.9-tuxcare.2 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.3.3 up to 4.3.3-tuxcare.2, plus listed versions 4.3.3-tuxcare.1 |
4.3.3-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
4.3.3 up to 4.3.3-tuxcare.2, plus listed versions 4.3.3-tuxcare.1 |
4.3.3-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.0.4 up to 5.0.4-tuxcare.1 | 5.0.4-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 3 CVEs |
5.0.4 up to 5.0.4-tuxcare.1 | 5.0.4-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.3.8 up to 4.3.8-tuxcare.2, plus listed versions 4.3.8-tuxcare.1 |
4.3.8-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
4.3.8 up to 4.3.8-tuxcare.2, plus listed versions 4.3.8-tuxcare.1 |
4.3.8-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.3.10 up to 4.3.10-tuxcare.12, plus listed versions 4.3.10-tuxcare.104.3.10-tuxcare.114.3.10-tuxcare.24.3.10-tuxcare.34.3.10-tuxcare.4 Show 7 moreShow less4.3.10-tuxcare.54.3.10-tuxcare.64.3.10-tuxcare.74.3.10-tuxcare.84.3.10-tuxcare.94.3.10.tuxcare4.3.10.tuxcare.1 |
4.3.10-tuxcare.12 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
4.3.10 up to 4.3.10-tuxcare.12, plus listed versions 4.3.10-tuxcare.104.3.10-tuxcare.114.3.10-tuxcare.24.3.10-tuxcare.34.3.10-tuxcare.4 Show 7 moreShow less4.3.10-tuxcare.54.3.10-tuxcare.64.3.10-tuxcare.74.3.10-tuxcare.84.3.10-tuxcare.94.3.10.tuxcare4.3.10.tuxcare.1 |
4.3.10-tuxcare.12 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.2.4.RELEASE up to 4.2.4.RELEASE-tuxcare.1 | 4.2.4.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
4.2.4.RELEASE up to 4.2.4.RELEASE-tuxcare.1 | 4.2.4.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.1.2.RELEASE up to 4.1.2.RELEASE-tuxcare.1 | 4.1.2.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
4.1.2.RELEASE up to 4.1.2.RELEASE-tuxcare.1 | 4.1.2.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.2, plus listed versions 3.0.10.RELEASE-tuxcare.1 |
3.0.10.RELEASE-tuxcare.2 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.2, plus listed versions 3.0.10.RELEASE-tuxcare.1 |
3.0.10.RELEASE-tuxcare.2 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.3.2 up to 4.3.2-tuxcare.1 | 4.3.2-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
4.3.2 up to 4.3.2-tuxcare.1 | 4.3.2-tuxcare.1 |
org.springframework.batch:spring-batch-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.0.1.RELEASE up to 4.0.1.RELEASE-tuxcare.1 | 4.0.1.RELEASE-tuxcare.1 |
org.springframework.batch:spring-batch-infrastructureTuxCare:Maven From an advisory covering 2 CVEs |
4.0.1.RELEASE up to 4.0.1.RELEASE-tuxcare.1 | 4.0.1.RELEASE-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, products, published | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47881 is a medium vulnerability (CVSS 5.9) in Broadcom Spring Batch, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. No source names a fixed version.