CVE-2026-47875 is a deserialization flaw in Spring Batch, scored CVSS 5.6 (medium) in the NVD record. It applies to applications using Jackson2ExecutionContextStringSerializer with an untrusted job repository data source. Spring fixed it in 6.0.5 for open source users, with enterprise builds for 6.0.4.1 and 5.2.7.
What's affected
The Spring advisory lists these affected versions of Spring Batch:
- 6.0.0 through 6.0.4
- 5.2.0 through 5.2.6
Fixed versions:
- 6.0.5 (open source)
- 6.0.4.1 (Enterprise Support only)
- 5.2.7 (Enterprise Support only)
The advisory says no further mitigation is needed after upgrading. The flaw only matters if your application deserializes execution contexts with Jackson2ExecutionContextStringSerializer and the job repository data comes from a source an attacker can influence. The NVD vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
Find the Spring Batch version.
Maven:
mvn dependency:tree -Dincludes=org.springframework.batch:spring-batch-core
Gradle:
gradle dependencies | grep spring-batch-core
Then check whether the serializer is in use.
grep -rn "Jackson2ExecutionContextStringSerializer" src/
If it is configured, ask who can write to the tables of your job repository. A database used only by your own application, with credentials held by that application, is a smaller exposure than one that other systems or users can write to.
What to do now
- List the Spring Batch applications you run and their versions.
- Search for Jackson2ExecutionContextStringSerializer in code and configuration.
- Upgrade to 6.0.5, or contact Spring about enterprise builds for 6.0.4.1 and 5.2.7.
- Restrict write access to the job repository database to the batch application itself.
- Review how job parameters reach the repository and treat anything from outside your control as untrusted.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. The advisory says a class named JobParameterDeserializer did not properly enforce the trusted types allowlist, so crafted input could lead to arbitrary code execution, including through known Jackson gadgets.
The attack needs a way to put hostile data into the job repository, which is why the score is medium and the exposure depends on your database access controls. Treat the repository as an input boundary. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-47875 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Does it matter if I use the default serializer?
The advisory ties the issue to Jackson2ExecutionContextStringSerializer. Check which serializer your application configures, and upgrade anyway.
Sources
Last reviewed: 19 October 2026.
