Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

MEDIUM | AUGUST 20, 2026 | CVE-2026-47878

Description

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.

This issue is in the same class as CVE-2020-5411, which addressed unsafe deserialization in Jackson2ExecutionContextStringSerializer.

The MongoDB backend and ResourcelessJobRepository are not affected.

Affected Spring Products and Versions

Spring Batch:

6.0.0 - 6.0.4
5.2.6 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
6.0.5	OSS
6.0.4.1	Enterprise Support Only
5.2.7	Enterprise Support Only

A strict ObjectInputFilter is now configured on the ObjectInputStream before any object is read inside DefaultExecutionContextSerializer.deserialize(). The default allowlist accepts only:

Standard JDK types
Spring Batch domain types

Any class outside this allowlist causes deserialization to fail immediately with InvalidClassException before any object graph is materialised.

Applications storing user-defined types in ExecutionContext: if your context map contains classes outside the default allowlist, inject a custom ObjectInputFilter via DefaultExecutionContextSerializer#setObjectInputFilter(ObjectInputFilter), extending DEFAULT_FILTER_PATTERN to include the additional classes.