Vulnerability · Published Aug 27, 2026 · Assigned by vmware
CVE-2026-47881Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in Spring Batch from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Batch | 6.0.0 – through 6.0.45.2.0 – through 5.2.64.3.0 – through 4.3.13 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H