CVE ID :CVE-2026-47065<\/p>\n
Published : June 3, 2026, 11:16 a.m. | 1\u00a0hour, 16\u00a0minutes ago<\/p>\n
Description :ZDRES-232: resolveProxyClass Not Overridden – acceptMatchers Filter Bypass via java.lang.reflect.Proxy<\/p>\n
Assessment: Fully addressed.<\/p>\n
When the serialised stream contains a TC_PROXYCLASSDESC (the marker
\nfor a java.lang.reflect.Proxy ), JDK\u2019s ObjectInputStream.readProxyDesc()
\n is
\ndispatched. JDK then calls the default
\nObjectInputStream.resolveProxyClass(interfaces) implementation, which
\nperforms Class.forName(intf, false, latestUserDefinedLoader()) for EACH
\ninterface name and constructs the proxy class \u00e2\u20ac\u201d bypassing the accepted
\n classes list .<\/p>\n
ZDRES-233: Class.forName(name, initialize=true, classLoader) in
\nreadClassDescriptor Triggers Static Initialiser of Allow-Listed Classes<\/p>\n
Assessment: Fully addressed.<\/p>\n
For ANY class on the allow-list, deserialising a stream that names it triggers the class\u2019s
\n (static initialiser) BEFORE any instance is constructed. This means an
\nattacker who supplies a class name on the allow-list (e.g., the
\ndeveloper wrote accept(\u201ccom.myapp.*”) , attacker supplies
\ncom.myapp.SomeClass ) causes of SomeClass \u00e2\u20ac\u201d and many
\nreal-world classes have side-effecting static initialisers<\/p>\n
Both issues have been fixed.<\/p>\n
Severity: 9.8 | CRITICAL<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID :CVE-2026-47065 Published : June 3, 2026, 11:16 a.m. | 1\u00a0hour, 16\u00a0minutes ago Description :ZDRES-232: resolveProxyClass Not Overridden – acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK\u2019s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which performs Class.forName(intf, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-79236","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/79236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=79236"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/79236\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=79236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=79236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=79236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}