Executive brief
Spring Batch is a framework used to process large volumes of data in batch jobs. The JDBC job repository, which stores job execution state, uses an unsafe Java object deserialization method that can be exploited to execute arbitrary code if an attacker can modify the stored data. This could compromise any system relying on Spring Batch for critical batch processing operations.
Technical details
The DefaultExecutionContextSerializer in Spring Batch's JDBC job repository deserializes Base64-encoded data using ObjectInputStream.readObject() without an ObjectInputFilter to restrict deserialization to a trusted class allowlist. This is a classic unsafe deserialization vulnerability (CWE-502) that allows remote code execution if an attacker can control or modify the serialized data stored in the job repository database. The attack vector is local or adjacent-network depending on database access controls; no network-level authentication bypass is required if database credentials are compromised or accessible. The vulnerability affects Spring Batch versions 5.2.6 and earlier, and 6.0.0 through 6.0.4. Patched versions are available in the Spring Security advisory.
Affected products
- Spring Spring Batch 5.2.6 and earlier, 6.0.0 - 6.0.4
Timeline
- 2026-08-27: disclosed