{"id":"spring-security-e225a062caed","seq":2075,"kind":"advisory","title":"cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist","url":"https://spring.io/security/cve-2026-47878","permalink":"https://vulnpulse.app/items/spring-security-e225a062caed","summary":"DefaultExecutionContextSerializer , used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. This issue is in the same class as CVE-2020-5411 , which addressed unsafe deserialization in Jackson2ExecutionContextStringSerializer . The MongoDB backend and ResourcelessJobRepository are not affected.","severity":null,"techs":["spring","java","mongodb"],"cves":["CVE-2026-47878","CVE-2020-5411"],"tags":["security"],"source":{"id":"spring-security","name":"Spring Security Advisories"},"published_at":"2026-08-20T00:00:00.000Z","fetched_at":"2026-10-21T16:17:45.704Z"}