Overview
About vulnerability
Spring Batch’s FlatFileItemReader supports files where a single logical record spans
multiple physical lines — for example, a CSV field that contains embedded newlines wrapped
in quotes. A specially crafted input file could exploit the way the reader assembles those
multi-line records to consume excessive CPU time and memory, causing the batch job to stall
or run out of memory.
This issue affects applications that use DefaultRecordSeparatorPolicy or JsonRecordSeparatorPolicy. The default policy (SimpleRecordSeparatorPolicy) is not
affected.
Details
- Affected product:
- Spring
- Affected packages:
- Spring Boot @ 2.6.15 (+1183 more)