Spring Batch CVE-2026-47881

Exploitation requires the attacker to supply a crafted flat file that FlatFileItemReader will process - meaning the batch job must read from a location the attacker can write to (e.g., a shared NFS mount, a cloud storage bucket without strict write ACLs, an upload endpoint that feeds files into the batch pipeline). The vulnerability is limited to jobs using FlatFileItemReader with multi-line record support enabled (i.e., files where logical records span multiple physical lines via quoted embedded newlines). Jobs that read only from write-protected, trusted internal sources are not exploitable regardless of patch status. The SSVC 'Automatable: no' rating confirms that exploitation is not drive-by or easily scripted - an attacker must have a pathway to inject a malicious file into the batch job's input location. No user interaction from an application user is required once the file is placed.

The official CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) represents a worst-case, deployment-optimistic assessment. The SSVC evaluation tempers this substantially: Exploitation is rated 'none', Automatable is 'no', and Technical Impact is 'partial'. The 'Automatable: no' finding is particularly relevant - it signals that exploitation is not a simple scan-and-trigger operation, consistent with the need for an attacker to control what files the batch job reads. The EPSS score of 0.27% (19th percentile) further confirms very low real-world exploitation probability. The primary risk is contextual: Spring Batch jobs that read files from publicly-writable or externally-controlled locations (user uploads, shared network paths, cloud storage buckets with permissive write policies) face material risk; jobs reading only internal, trusted files face negligible exposure. No active exploitation and no public PoC exist at time of analysis.

An attacker with write access to a directory or object store bucket from which a Spring Batch job reads input files uploads a specially crafted CSV file containing deeply nested or pathologically structured quoted multi-line fields. When the scheduled or triggered batch job's FlatFileItemReader processes the file, the record-assembly logic enters an unbounded loop consuming CPU and heap, eventually stalling the job executor or triggering an OutOfMemoryError, disrupting dependent downstream processing. No public exploit code has been identified at time of analysis.