cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. This issue affects applications that use DefaultRecordSeparatorPolicy or JsonRecordSeparatorPolicy . The default policy ( SimpleRecordSeparatorPolicy ) is not affected.

Spring Security Advisoriesで読む