The fix is included in these releases and requires no code changes for most applications. After upgrading, the reader enforces safe default limits on how large a single multi-line record may grow: at most 1 000 physical lines and 1 MiB of accumulated text. If a file exceeds either limit, the reader stops immediately with a clear error message instead of continuing to process a potentially malicious input.

If your application might read files with records larger than these defaults, you can raise the limits on the reader:

// Direct use
FlatFileItemReader<MyItem> reader = new FlatFileItemReader<>(lineMapper);
reader.setMaxLinesPerRecord(5_000);   // raise the line cap
reader.setMaxBytesPerRecord(5 * 1024 * 1024);  // raise the size cap to 5 MiB

// Via the builder
FlatFileItemReader<MyItem> reader = new FlatFileItemReaderBuilder<MyItem>()
        .name("myReader")
        .resource(resource)
        .maxLinesPerRecord(5_000)
        .maxBytesPerRecord(5 * 1024 * 1024)
        // ... rest of configuration
        .build();

Setting either limit to Integer.MAX_VALUE effectively disables it; this is not recommended when processing files from untrusted sources.

If upgrading is not immediately possible, add an application-level check that rejects files above a safe size threshold before they are opened by the reader, or switch to SimpleRecordSeparatorPolicy if multi-line record support is not required by your use case.