cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer , used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. This issue is in the same class as CVE-2020-5411 , which addressed unsafe deserialization in Jackson2ExecutionContextStringSerializer . The MongoDB backend and ResourcelessJobRepository are not affected.
Spring Security Advisories에서 읽기
| CVE | CVE-2026-47878 CVE-2020-5411 |
|---|---|
| 정보원 | Spring Security Advisories |
| 수집 시각 | 2026. 10. 22. 오전 01:17 |
| 데이터 | Markdown JSON |
2026. 08. 20. 오전 09:00, Spring Security Advisories에서 "cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist"을(를) 게시했습니다 (유형: 취약점 권고). 관련 기술: Spring, Java, MongoDB. CVE: CVE-2026-47878, CVE-2020-5411.