The vulnerability occurs in Spring Batch's default serialization logic, which decodes stored job context data from Base64 and feeds it directly to ObjectInputStream.readObject() without applying an ObjectInputFilter or class allowlist. This omission allows an adversary to craft a malicious serialized payload that an application will deserialize during job execution, leading to arbitrary code execution or other destructive actions in the context of the batch process. The weakness is a classic example of insecure deserialization, identified by CWE-502.

Affected versions include Spring Batch 6.0.0 through 6.0.4 and all releases 5.2.6 and earlier. These versions employ the vulnerable DefaultExecutionContextSerializer in the JDBC job repository. Any deployment running one of these releases that accepts deserialized job data is at risk. All versions before 6.0.5 should be considered impacted, until a patch is applied.

The CVSS score of 5.6 classifies this issue as medium severity. No EPSS data is available, and it is not listed in CISA’s KEV catalog, which suggests that the vulnerability has not yet been widely observed in the wild. However, the absence of a type filter means that if an attacker can influence the contents of the job repository database or supply a pre‑written malicious serialized object, the execution of arbitrary code is possible. The most likely attack vector is the use of unauthenticated or improperly authorized access to the database that stores job contexts, allowing an attacker to inject the payload. Because the deserialization occurs during normal job execution, any privileged batch process or application service that starts jobs will be affected.