CVE-2026-43867

camel-pqc AWS Secrets Manager 密钥元数据不安全反序列化复现工具（CVE-2026-43867） 本项目演示了 Apache Camel 的 camel-pqc 组件中的一个 Java 反序列化漏洞 ，编号为 CVE-2026-43867 。AwsSecretsManagerKeyLifecycleManager.deserializeMetadata 从 AWS Secrets Manager 的密钥中读取持久化的后量子密钥元数据，其流程是对存储的值进行 Base64 解码，然后使用原始的 java.io.ObjectInputStream.readObje...

CVE-2026-40473

camel-mina MinaConverter.toObjectInput Reproductor de deserialización insegura CVE-2026-40473 Este proyecto demuestra una vulnerabilidad de deserialización en Java en el componente camel-mina de Apache Camel, registrada como CVE-2026-40473. El convertidor de tipos...

xmlrpc-common-deserialization

xmlrpc-common deserialization vulnerability This note is a technical note to detail the root cause and the associated exploit. You can find the initial disclosure here. The associated CVE is CVE-2019-17570. Description xmlrpc-common forms a shared code base between xmlrpc-client and xmlrpc-server...

lazylist-cve-poc

CVE-2022-36944 payload 生成器 这个小项目用于演示 CVE-2022-36944 漏洞的概念验证。它与 ysoserial 类似，但仅针对该 CVE 生成使用 LazyList 类的 payload。 快速 FAQ 哪些构件带来了该漏洞？ 版本在 2.13.9 之前的 org.scala-lang:scala-library 哪些应用程序易受攻击？ 要使你的应用程序可利用，必须同时满足两个条件： 你的应用程序的 classpath 中包含易受攻击的 scala-library jar 你的应用程序中某处最终调用了...

CVE-2026-86404

Red Hat EAP 's Artemis messaging component permits deserialization by default due to a misconfiguration in its security filtering. Specifically, ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which applies allow-list/block-list filtering via checkSecurity()/isTrustedType(). Howe...

CVE-2026-40858

camel-infinispan 远程聚合存储库不安全反序列化复现工具 CVE-2026-40858 本项目演示了 Apache Camel 的 camel-infinispan 组件中的一个 Java 反序列化漏洞 ，追踪编号为 CVE-2026-40858 。基于 ProtoStream 的 远程聚合存储库 将每个聚合的 Exchange 序列化到远程 Infinispan 缓存中，当它读回一个条目时（在 get / recover 时），使用 java.io.ObjectInputStream 且 没有ObjectInputFilter...

CVE-2026-40859

camel-netty-http / camel-vertx-http HTTP响应不安全反序列化复现器 CVE-2026-40859 本项目演示了 Apache Camel 的 camel-netty-http 和 camel-vertx-http 组件中的一个 Java 反序列化漏洞 ，编号为 CVE-2026-40859 。当生产者端点配置了 transferException=true（或组件级别的 allowJavaSerializedObject=true）时，后端 HTTP 响应 带有失败状态和 Content-Type:...

CVE-2026-40048

camel-pqc FileBasedKeyLifecycleManager 不安全反序列化复现工具 CVE-2026-40048 该项目演示了 Apache Camel 的 camel-pqc 组件中的 Java 反序列化漏洞 ，追踪编号为 CVE-2026-40048 。FileBasedKeyLifecycleManager 从配置的密钥目录中读取 .key 文件，使用原始的 ObjectInputStream 且未设置 ObjectInputFilter，因此能够写入该目录的攻击者可实现 远程代码执行 。...

SerialKillerBypassGadgetCollection

SerialKiller: Colección de Bypass Gadgets Descripción Colección de Bypass Gadgets que se pueden usar en cadenas de gadgets de deserialización JVM para evadir la deserialización defensiva de "Look-Ahead ObjectInputStreams". Publicada como parte de la charla de RSA 2016 "SerialKiller: Silently Pwni...

CVE-2026-6009

⚠️ Disclaimer: This repository is for educational purposes and authorized security testing only. Do not use against systems you do not own or have explicit written permission to test. CVE-2026-6009 Proof of Concept Summary The Jaspersoft report library version = 7.0.3 is vulnerable to a remote cod...

CVE-2026-47878

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

CVE-2026-47864

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...

EUVD-2026-66841

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...

PT-2026-82394

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier Description The...

CVE-2026-75987

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible...

CVE-2026-75987 SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible...

EUVD-2026-62221

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible...

CVE-2026-75987

SPLWare esProc up to 20260507 deserializes untrusted network input via ObjectInputStream.readUnshared in SocketData.java, enabling remote unauthenticated code execution (CVSS 7.5 HIGH). No fix or exploit details are provided. No in-the-wild exploitation reported.

Deserialization Of Untrusted Data

Apache Camel PQC component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unfiltered Java deserialization in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager, where...