cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer , used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. This issue is in the same class as CVE-2020-5411 , which addressed unsafe deserialization in Jackson2ExecutionContextStringSerializer . The MongoDB backend and ResourcelessJobRepository are not affected.
Read on Spring Security Advisories
| CVE | CVE-2026-47878 CVE-2020-5411 |
|---|---|
| Source | Spring Security Advisories |
| Fetched | 10/22/2026, 01:17 AM |
| Data | Markdown JSON |
On 08/20/2026, 09:00 AM, Spring Security Advisories published "cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist" (type: Advisory). Related technologies: Spring, Java, MongoDB. CVE: CVE-2026-47878, CVE-2020-5411.