CVE-2020-5411: Deserialization of Untrusted Data in Spring Batch
Summary
CVE-2020-5411: Deserialization of Untrusted Data in Spring Batch. Affects org.springframework.batch:spring-batch-core versions >= 4.0.0, < 4.2.3. Fixed in 4.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Batch is a framework for batch processing in Java. It provides reusable components and patterns for processing large volumes of data in batch jobs. The framework leverages Jackson for serialization and deserialization of data. Jackson is a popular JSON library for Java that allows developers to convert Java objects to JSON and vice versa. However, Jackson had a deserialization vulnerability that could lead to arbitrary code execution. Spring Batch's default configuration enabled this vulnerability, making it susceptible to attacks if a malicious user gains write access to the data store used by the JobRepository.
Vulnerability Detail
The vulnerability in Spring Batch arises from the default typing feature of Jackson. When default typing is enabled, Jackson attempts to infer the type of the object being deserialized based on the serialized data. This can be exploited by an attacker by providing maliciously crafted serialized data that triggers the execution of arbitrary code during deserialization. In the context of Spring Batch, this vulnerability can be exploited if the job's ExecutionContext is serialized using Jackson and a malicious user gains write access to the JobRepository's data store. To mitigate this vulnerability, Jackson has blacklisted known "deserialization gadgets" to prevent their deserialization. Spring Batch should also proactively block unknown "deserialization gadgets" when enabling default typing.
How To Fix
Latest published version: 6.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a workaround is to disable default typing in Jackson. This can be done by configuring Jackson's ObjectMapper with the disableDefaultTyping() method. However, disabling default typing may impact the functionality of the application if it relies on polymorphic deserialization. It is recommended to thoroughly test the application after applying this workaround.
Conclusion
The deserialization vulnerability in Spring Batch can lead to arbitrary code execution if a malicious user gains write access to the JobRepository's data store. It is crucial to upgrade to Spring Batch version 4.2.3 or later to fix this vulnerability. Alternatively, you can disable default typing in Jackson, but this may have implications on the application's functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.batch:spring-batch-core →
FAQ
Spring Batch is a framework for batch processing in Java. It provides reusable components and patterns for processing large volumes of data in batch jobs.
Jackson is a popular JSON library for Java that allows developers to convert Java objects to JSON and vice versa.
Default typing is a feature in Jackson that enables the serialization and deserialization of polymorphic types without explicitly specifying the type information.
The deserialization vulnerability in Jackson can be exploited in Spring Batch if the job's ExecutionContext is serialized using Jackson and a malicious user gains write access to the JobRepository's data store. This can lead to arbitrary code execution.
The deserialization vulnerability can be mitigated by upgrading to Spring Batch version 4.2.3 or later, which includes the fix for the vulnerability. Alternatively, you can disable default typing in Jackson, but this may impact the functionality of the application.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.batch:spring-batch-core.
