Vulnerability Details CVE-2026-47881
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.0 - 5.2.6
Spring Batch 4.3.0 - 4.3.13
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 19.4%
CVSS Severity
CVSS v3 Score 5.9
References
Products affected by CVE-2026-47881
-
cpe:2.3:a:broadcom:spring_batch:4.3.0
-
cpe:2.3:a:broadcom:spring_batch:4.3.1
-
cpe:2.3:a:broadcom:spring_batch:4.3.10
-
cpe:2.3:a:broadcom:spring_batch:4.3.2
-
cpe:2.3:a:broadcom:spring_batch:4.3.3
-
cpe:2.3:a:broadcom:spring_batch:4.3.4
-
cpe:2.3:a:broadcom:spring_batch:4.3.5
-
cpe:2.3:a:broadcom:spring_batch:4.3.6
-
cpe:2.3:a:broadcom:spring_batch:4.3.7
-
cpe:2.3:a:broadcom:spring_batch:4.3.8
-
cpe:2.3:a:broadcom:spring_batch:4.3.9
-
cpe:2.3:a:broadcom:spring_batch:6.0.0
-
cpe:2.3:a:broadcom:spring_batch:6.0.1
-
cpe:2.3:a:broadcom:spring_batch:6.0.2
-
cpe:2.3:a:broadcom:spring_batch:6.0.3
-
cpe:2.3:a:broadcom:spring_batch:6.0.4