CVE-2026-47881: Spring Batch, отказ на услуга

Описание

Оригинално описание

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13

Засегнати продукти

• Spring Spring Batch: 6.0.0 до 6.0.4; 5.2.0 до 5.2.6; 4.3.0 до 4.3.13

Вид слабост

• CWE-400 Неконтролирано потребление на ресурси

История

Други уязвимости в Spring Spring Batch

• 5.6CVE-2026-47878
• 5.6CVE-2026-47875
• CVE-2019-3774

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-47881
• https://nvd.nist.gov/vuln/detail/CVE-2026-47881
• https://spring.io/security/cve-2026-47881