CVE-2019-3774: XML External Entity Injection in org.springframework.batch:spring-batch-core
Summary
CVE-2019-3774: Low severity vulnerability that affects org.springframework.batch:spring-batch-core. Affects org.springframework.batch:spring-batch-core across 3 version ranges.
< 3.0.10
>= 4.0.0, < 4.0.2
>= 4.1.0, < 4.1.1
Fixed in 3.0.10, 4.0.2 or 4.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.springframework.batch:spring-batch-core is a Maven package that provides functionality for batch processing in Spring applications. It allows developers to define and execute complex batch jobs. However, versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions of this package are vulnerable to XML External Entity Injection (XXE) when processing XML data from untrusted sources.
Vulnerability Detail
XML External Entity Injection (XXE) is a vulnerability that allows an attacker to exploit an XML parser's functionality to disclose internal files, perform remote code execution, or launch denial-of-service attacks. In the case of org.springframework.batch:spring-batch-core, the vulnerability arises when processing XML data from untrusted sources, potentially leading to unauthorized access to sensitive information or system compromise.
How To Fix
Latest published version: 6.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.0.103.0.10 -
>= 4.0.0, < 4.0.24.0.2 -
>= 4.1.0, < 4.1.14.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions mentioned above to address the issue.
Conclusion
The vulnerability in org.springframework.batch:spring-batch-core exposes applications to XML External Entity Injection (XXE) attacks. To mitigate this risk, it is crucial to update to the fixed versions: 3.0.10, 4.0.2, or 4.1.1, depending on the currently used version. For further assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework.batch:spring-batch-core →
FAQ
XML External Entity Injection (XXE) is a vulnerability that allows an attacker to exploit an XML parser's functionality to disclose internal files, perform remote code execution, or launch denial-of-service attacks.
This vulnerability affects versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions of org.springframework.batch:spring-batch-core. It allows an attacker to perform XML External Entity Injection when processing XML data from untrusted sources, potentially leading to unauthorized access or system compromise.
No, there are no known workarounds for this vulnerability. It is essential to update to the fixed versions of org.springframework.batch:spring-batch-core.
To fix this vulnerability, update org.springframework.batch:spring-batch-core to the fixed versions: 3.0.10, 4.0.2, or 4.1.1, depending on the currently used version.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/01/GHSA-3wc8-659g-r88q/GHSA-3wc8-659g-r88q.json
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.batch:spring-batch-core.
