PatchTheCVEspring batch vulnerabilities and fixes
Recent CVEs affecting spring batch, with upgrade or downgrade steps. 3 tracked.
Also searched as: springbatch.
spring batch has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-08-27. Highest priority: CVE-2026-47875 (score 34/100).
- CVE-2026-47878 MEDIUM 5.6 UPGRADE DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decode
- CVE-2026-47875 MEDIUM 5.6 UPGRADE Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable
- CVE-2026-47881 MEDIUM 5.9 UPGRADE Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines —
FAQ
How do I fix spring batch vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring batch being exploited right now?
None of the tracked spring batch CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring batch CVE should I patch first?
CVE-2026-47875 currently ranks highest (34/100): Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable .