Vulnerability Details CVE-2026-47875
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.0 - 5.2.6
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 16.0%
CVSS Severity
CVSS v3 Score 5.6
References
Products affected by CVE-2026-47875
-
cpe:2.3:a:broadcom:spring_batch:5.2.0
-
cpe:2.3:a:broadcom:spring_batch:5.2.1
-
cpe:2.3:a:broadcom:spring_batch:5.2.2
-
cpe:2.3:a:broadcom:spring_batch:5.2.3
-
cpe:2.3:a:broadcom:spring_batch:5.2.4
-
cpe:2.3:a:broadcom:spring_batch:5.2.5
-
cpe:2.3:a:broadcom:spring_batch:5.2.6