CVE-2026-47875 Overview
CVE-2026-47875 is a deserialization vulnerability in Spring Batch affecting applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer. The JobParameterDeserializer fails to enforce the trusted-types allowlist. Attackers can craft malicious input that triggers arbitrary code execution through known Jackson RCE gadgets when the job repository consumes untrusted data. The flaw affects Spring Batch versions 6.0.0 through 6.0.4 and 5.2.0 through 5.2.6. This is classified as an Insecure Deserialization weakness [CWE-502].
Critical Impact
Successful exploitation can lead to arbitrary code execution on hosts running vulnerable Spring Batch applications that read execution contexts from untrusted sources.
Affected Products
- Spring Batch 6.0.0 through 6.0.4
- Spring Batch 5.2.0 through 5.2.6
- Applications using Jackson2ExecutionContextStringSerializer with untrusted job repositories
Discovery Timeline
- 2026-08-27 - CVE CVE-2026-47875 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-47875
Vulnerability Analysis
Spring Batch serializes and deserializes job execution contexts to persist state across job runs. The Jackson2ExecutionContextStringSerializer component uses Jackson to convert stored state back into Java objects when a job resumes. Applications that back this serialization with a job repository fed by untrusted data expose the deserialization path to attacker-controlled input.
The attack requires reaching the deserialization routine through the job repository. Attackers who can write to that data source can supply crafted payloads that exploit Jackson polymorphic type handling. Impact includes arbitrary code execution in the context of the Spring Batch application.
Root Cause
The JobParameterDeserializer does not properly enforce the trusted-types allowlist that Spring Batch intends to apply during Jackson deserialization. Without a strict allowlist, Jackson can instantiate arbitrary types referenced in the serialized payload. This behavior enables the well-documented class of Jackson deserialization gadget chains that culminate in remote code execution.
Attack Vector
Exploitation requires that the job repository or execution context store contain attacker-supplied data. An attacker with write access to that data source, or the ability to influence values that flow into it, can inject serialized job parameters referencing malicious types. When Spring Batch loads and deserializes the execution context, the gadget chain executes.
No authentication is required at the network layer for the deserialization primitive itself, but the attacker must have a path to write into the job repository. See the Spring Security Advisory CVE-2026-47875 for authoritative technical details.
Detection Methods for CVE-2026-47875
Indicators of Compromise
- Unexpected child processes spawned by Java processes running Spring Batch jobs
- Job repository entries containing serialized parameters with unusual @class or type identifier fields referencing classes outside the application's normal domain
- Outbound network connections initiated by Spring Batch worker processes to unexpected hosts
- Deserialization exceptions in application logs referencing Jackson2ExecutionContextStringSerializer or JobParameterDeserializer
Detection Strategies
- Inspect job repository tables such as BATCH_JOB_EXECUTION_CONTEXT and BATCH_STEP_EXECUTION_CONTEXT for serialized values containing polymorphic type hints tied to known Jackson gadget classes
- Monitor Java runtime behavior for reflective class loading of classes commonly abused in Jackson gadget chains
- Alert on Spring Batch application processes that execute shell commands or spawn scripting interpreters
Monitoring Recommendations
- Enable audit logging on the database or datastore used by the Spring Batch job repository
- Instrument application logs to capture deserialization failures and unexpected class resolution events
- Correlate job execution start events with process and network telemetry to detect deviation from baseline job behavior
How to Mitigate CVE-2026-47875
Immediate Actions Required
- Upgrade Spring Batch to a fixed release beyond 6.0.4 or 5.2.6 as published in the Spring Security Advisory
- Restrict write access to the job repository so only trusted application components can insert or modify execution context data
- Audit existing job repository content for suspicious serialized payloads before restarting jobs on patched builds
Patch Information
Refer to the Spring Security Advisory CVE-2026-47875 for the fixed version numbers and upgrade instructions. The fix hardens JobParameterDeserializer to enforce the trusted-types allowlist during Jackson deserialization.
Workarounds
- Configure Spring Batch to use a serializer that does not perform polymorphic Jackson deserialization when a patch cannot be applied immediately
- Isolate the job repository behind network and identity controls that prevent untrusted principals from writing execution context data
- Apply a Jackson-level custom deserializer or type validator that enforces an explicit allowlist of permitted classes
# Configuration example
# Verify installed Spring Batch version in a Maven project
mvn dependency:tree | grep spring-batch
# Verify installed Spring Batch version in a Gradle project
./gradlew dependencies | grep spring-batch
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
