Deserialization Flaw in AWS Advanced JDBC Wrapper

Executive Summary

CVE-2026-14265 is a vulnerability in the AWS Advanced JDBC Wrapper, specifically in the RemoteQueryCachePlugin. It involves the unsafe deserialization of untrusted data from a shared cache (Redis or Valkey) without proper class filtering. An attacker who has write access to this shared cache can inject a malicious serialized Java object. When the application server reads and deserializes this poisoned cache entry, it can lead to arbitrary code execution on the server.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unsafe deserialization in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0. Detection would focus on identifying the presence and usage of these vulnerable versions and monitoring for suspicious serialized Java objects in the shared Redis or Valkey cache.

Since the vulnerability arises from deserialization of untrusted data from Redis or Valkey caches, you can check for the presence of the vulnerable AWS Advanced JDBC Wrapper versions in your environment by inspecting application dependencies or runtime versions.

Additionally, monitoring write access to the Redis or Valkey cache for unusual or unauthorized activity can help detect attempts to exploit this vulnerability.

Specific commands to detect vulnerable versions or suspicious activity are not provided in the available resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with write access to the shared cache infrastructure to execute arbitrary code on your application servers. This means the attacker could potentially take control of the server, access sensitive data, disrupt services, or perform other malicious actions. The impact includes high risks to confidentiality, integrity, and availability of your systems.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in the AWS Advanced JDBC Wrapper RemoteQueryCachePlugin, you should upgrade to version 4.0.1 or later, which includes fixes to prevent unsafe Java deserialization.

As a temporary workaround, you can disable the RemoteQueryCachePlugin to prevent deserialization of untrusted data.

Additionally, restrict write access to the shared Redis or Valkey cache infrastructure to trusted users only, to prevent attackers from injecting malicious serialized Java objects.

Useful 0 Not Useful 0