zknews

trending2

tag: deserialization ✕

01▲
CVE-2026-43867 - Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter secalerts.co
How did Camel-PQC store key metadata? Raw ObjectInputStream, no filter, so a crafted secret can trigger deserialization side effects.
aws deserialization java pqc security twitter
4 pts/fewergates/2 days ago/1 comment
02▲
CVE-2026-42779: Apache MINA-Deserialization Allowlist Bypass to RCE blog.securelayer7.net
Write-up on an Apache MINA deserialization allowlist bypass to RCE, complete with PoC and patch autopsy; Java keeps delivering.
allowlist-bypass apache deserialization exploit java mina rce twitter vulnerability
0 pts/pavelennis/29 days ago/4 comments