## cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

- 種別: advisory
- 関連技術: spring, java, mongodb
- CVE: CVE-2026-47878, CVE-2020-5411
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-47878)
- パーマリンク: https://vulnpulse.app/items/spring-security-e225a062caed

DefaultExecutionContextSerializer , used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. This issue is in the same class as CVE-2020-5411 , which addressed unsafe deserialization in Jackson2ExecutionContextStringSerializer . The MongoDB backend and ResourcelessJobRepository are not affected.