Broadcom Spring Batch vulnerabilities

5 CVEs affecting Broadcom Spring Batch, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47881, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3774, published 2019-01-18. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVE-2020-5411, published 2020-06-11. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known…
CVE-2026-47875, published 2026-08-27. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository.…
CVE-2026-47881, published 2026-08-27. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially…
CVE-2026-47878, published 2026-08-27. High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days. DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that…