CVE-2026-47881mediumCWE-400

CVE-2026-47881: falha de média gravidade em Spring Batch

Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File

Publicada em

Seguir esta CVE+ Monitorar Spring Batch

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 0.4%
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Spring · Spring Batch
CVEs relacionadas — Spring Batch

No mesmo produto, das mais perigosas para as menos.

CVE-2019-3774—Spring Batch XML External Entity Injection (XXE)EPSS 3.1%CVE-2026-47875MEDIUMJobParameterDeserializer bypasses the trusted-type allowlistEPSS 0.4%CVE-2026-47878MEDIUMUnsafe Java deserialization in DefaultExecutionContextSerializer without class allowlistEPSS 0.4%