Executive brief
Spring Batch is a Java framework used to build batch processing jobs that read and transform large data files. The FlatFileItemReader component is vulnerable to a denial of service attack where a specially crafted input file with multi-line CSV records can cause excessive CPU consumption and memory exhaustion, stalling batch jobs or forcing them to crash.
Technical details
The vulnerability exists in Spring Batch's FlatFileItemReader, which supports logical records that span multiple physical lines (e.g., CSV fields with embedded newlines wrapped in quotes). A specially crafted input file can exploit the way the reader assembles multi-line records, causing it to consume excessive CPU time and memory. The attack requires supplying a malicious file to a batch job, making the attack vector local or adjacent depending on how the file is sourced. No authentication is required; the vulnerability is triggered during normal file parsing operations. An attacker can cause a batch job to stall or run out of memory (denial of service). Patches are available in Spring Batch 6.0.5, 5.2.7, and 4.3.14.
Affected products
- Spring Spring Batch 4.3.0 - 4.3.13, 5.2.0 - 5.2.6, 6.0.0 - 6.0.4
Timeline
- 2026-08-27: disclosed