CVE-2026-47878

The DefaultExecutionContextSerializer in Spring Batch versions 6.0.0 to 6.0.4 and 5.2.6 and earlier is vulnerable due to its handling of Base64-decoded bytes, which are passed directly to ObjectInputStream.readObject() without an appropriate ObjectInputFilter. This oversight allows for potential deserialization attacks, enabling an attacker to execute arbitrary code if they can manipulate the input data. Organizations using affected versions of Spring Batch should prioritize patching to mitigate the risk of exploitation.