Not rated
CVE-2019-3774 Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity…
Description
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Batch 4.1 | 4.1 → < 4.1.0.RELEASE | 4.1.0.RELEASE |
| Spring Batch 4.0 | 4.0 → < 4.0.1.RELEASE | 4.0.1.RELEASE |
| Spring Batch 3.0 | 3.0 → < 3.0.9.RELEASE | 3.0.9.RELEASE |
Other CVEs of Spring Batch
The 4 CVEs of Spring Batch →
CVE-2026-47881
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for…
5.9
Medium
CVE-2026-47878
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes…
5.6
Medium
CVE-2026-47875
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a…
5.6
Medium