CVE-2026-47878 - DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier - 漏洞详情

漏洞描述

相关链接

相关漏洞

• CVE-2026-78032 [未知] CVE-2026-78032 - SOY CMS contains an issue with deserialization of un…
• CVE-2026-10036 [高危] CVE-2026-10036 - SpeechBrain before 1.1.1 contains an arbitrary code e…
• CVE-2026-78292 [危急] CVE-2026-78292 - Unauthenticated PHP Object Injection in Hash Form
• CVE-2026-78276 [高危] CVE-2026-78276 - Editor PHP Object Injection in Fluent Boards Pro
• CVE-2026-59275 [中危] CVE-2026-59275 - A single hostile AMQP message can terminate the entir…
• CVE-2026-47878 [中危] CVE-2026-47878 - DefaultExecutionContextSerializer, used by default in…
• CVE-2026-47875 [中危] CVE-2026-47875 - Applications that deserialize execution contexts with…
• CVE-2026-47864 [中危] CVE-2026-47864 - SerializingHttpMessageConverter deserializes the body…