CyberSec.Space Logo
Back to CVE Browser

CVE-2026-14265

HIGH
7.5
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2026-07-01
Last Modified2026-07-09
Data SourcesNVD

Vulnerability Description

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.

Affected Platforms (CPE)

No CPE configurations currently published for this record.

References & Advisories

🔗 https://aws.amazon.com/security/security-bulletins/2026-051-aws/
🔗 https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1
🔗 https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-c5q4-97jw-jggh

Related Vulnerabilities

CVE-2026-660535.9

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache T...

CVE-2026-586628.7

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue af...

CVE-2026-583898.7

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thri...

CVE-2026-580236.9

Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are re...