Executive brief
Spring Batch is a widely-used framework for batch processing in Java applications. The vulnerability allows attackers to execute arbitrary code on systems using Spring Batch when processing untrusted job execution data. An attacker could leverage this to compromise applications and their underlying servers, potentially leading to data theft, service disruption, or complete system takeover.
Technical details
The vulnerability is a deserialization attack affecting Jackson2ExecutionContextStringSerializer in Spring Batch. The JobParameterDeserializer fails to properly enforce a trusted-types allowlist, permitting an attacker to craft malicious serialized input that bypasses type restrictions. When an application deserializes execution contexts from an untrusted job repository source, an attacker can inject known Jackson RCE gadget chains to achieve arbitrary code execution. The attack requires an untrusted data source for the job repository but does not require prior authentication or user interaction.
Affected products
- Spring Batch 6.0.0-6.0.4, 5.2.0-5.2.6
Timeline
- 2026-08-27: disclosed