Spring Batch’s FlatFileItemReader can process logical records that span multiple physical lines, such as CSV fields containing embedded newlines. A maliciously crafted input file can cause the reader to assemble these multi‑line records in a way that consumes excessive CPU and memory. The resulting resource exhaustion can stall the batch job or exhaust available memory, rendering the application unavailable to legitimate users.

The affected products are Spring Batch versions 4.3.0 through 4.3.13, 5.2.0 through 5.2.6, and 6.0.0 through 6.0.4. These are deployed in any Java application that uses the FlatFileItemReader component for batch processing.

The CVSS score of 5.9 indicates a moderate severity risk for denial of service. No EPSS score is available, so the likelihood of exploitation is currently unknown. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote, depending on the environment where input files are accepted; an attacker who can supply malformed files to the reader gain is able to trigger the debtilation. No workaround has been documented, making patching the most reliable response.