EUVD-2026-41132Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain write access to shared Redis/Valkey cache
-
DeliveryPoison query-result key with serialized gadget object
-
ExploitApp server reads poisoned cache entry
-
ExecutionObjectInputStream deserializes without filtering
-
ImpactGadget chain executes arbitrary code on app server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target deployment uses the AWS Advanced JDBC Wrapper (3.3.0-4.0.0) with the RemoteQueryCachePlugin enabled and backed by a Redis or Valkey cache, and that the attacker has write access to that shared cache infrastructure (reflected as AT:P/PR:L in the CVSS 4.0 vector). A usable Java deserialization gadget chain must also exist on the application server's classpath for code execution rather than a mere crash. Limiting factors: the RemoteQueryCachePlugin is an opt-in, non-default feature; the cache must be attacker-writable (so an isolated, authenticated Redis/Valkey materially blocks the attack); no user interaction is needed and the trigger is automatic on the next cache read by any consuming app server. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.7 High) is internally consistent with the description: network reachable, low complexity, but with an Attack Requirement (AT:P) and low privileges (PR:L) reflecting that the attacker must first obtain write access to the shared cache infrastructure and the deployment must actually enable the RemoteQueryCachePlugin backed by Redis/Valkey. This is a genuine full-CIA-impact RCE, but it is a conditional/second-order flaw rather than a straight internet-facing unauthenticated bug - the AT:P and PR:L honestly capture that the cache write foothold is the gating precondition. No KEV listing and no EPSS score were provided; treat exploitation probability as unquantified but currently no public exploit is identified. The key limiting factor is exposure of the Redis/Valkey instance: if that cache is network-isolated and authenticated, real-world risk drops sharply; if it is shared, unauthenticated, or reachable by lower-trust services, the blast radius is every app server reading the cache, making this a high priority for affected deployments. |
| Exploit ScenarioDerived | An attacker who has gained write access to the shared Redis/Valkey instance (for example via an exposed or weakly-authenticated cache, or a compromised lower-trust service that shares the cache) stores a crafted serialized Java gadget-chain object under a query-result cache key. When any application server using the RemoteQueryCachePlugin next reads that key, ObjectInputStream deserializes the payload and executes attacker code in the application process. No public POC is identified, but the technique relies on well-known Java deserialization gadget chains and low attack complexity once cache-write access exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 01, 2026
Arbitrary code execution in Amazon's AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) arises from the RemoteQueryCachePlugin deserializing cached query results from Redis or Valkey via a raw ObjectInputStream with no class filtering. An actor able to write to the shared cache can poison entries with a crafted serialized Java object, triggering gadget-chain execution on every application server that later reads that cache entry. No public exploit identified at time of analysis; risk is elevated because a single poisoned cache key fans out to all consuming app servers.
Earlier versions of this analysis (2)
Remote code execution in AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 lets an actor with write access to the shared Redis/Valkey cache backing the RemoteQueryCachePlugin poison cache entries with a crafted serialized Java object, executing arbitrary code on any application server that later reads those cached query results. The flaw stems from unfiltered Java deserialization (CWE-502) of cache payloads. No public exploit identified at time of analysis, and this is not listed in CISA KEV; the vendor released a fix in version 4.0.1 that adds a deserialization allowlist.
Unsafe Java deserialization in the RemoteQueryCachePlugin of the AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) lets an actor with write access to the shared Redis/Valkey cache poison stored query results and achieve remote code execution on any application server that reads those cached entries. The plugin reads cache values through ObjectInputStream with no class allow-listing, so a crafted serialized object triggers gadget-chain execution when the entry is deserialized. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; AWS has published a fixed release (4.0.1).
RemediationAI
Vendor-released patch: upgrade to AWS Advanced JDBC Wrapper version 4.0.1 or later (release: https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1), which is the primary and recommended fix. If you cannot upgrade immediately, disable the RemoteQueryCachePlugin (or switch to a local/in-memory cache that is not shared or externally writable) to remove the untrusted deserialization path, accepting the trade-off of losing shared cross-instance query caching. Additionally, restrict and authenticate the Redis/Valkey cache so only trusted application servers can write to it (enable AUTH/ACLs, bind to private subnets, enforce TLS, and block the cache port from untrusted networks) - this reduces the attacker's ability to poison entries but does not by itself close the class-filtering gap, so patching remains required. Track fix details via the AWS bulletin (https://aws.amazon.com/security/security-bulletins/2026-051-aws/) and GHSA-c5q4-97jw-jggh.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The AWS Advanced JDBC Wrapper is a Java JDBC driver shim that layers connection management, failover, and caching plugins over an underlying database driver. The RemoteQueryCachePlugin stores and retrieves query results in an external Redis/Valkey cache so multiple application instances can share cached results. Per CWE-502 (Deserialization of Untrusted Data), the root cause is the use of java.io.ObjectInputStream.readObject() against attacker-influenceable bytes without an allow-list (e.g., ObjectInputFilter/setObjectInputFilter). Because Redis/Valkey stores the serialized Java objects verbatim, any writer to that cache controls the byte stream that gets deserialized, and if a known gadget chain (e.g., from commons-collections or similar libraries on the classpath) is present, deserialization becomes remote code execution. The affected component is identified by cpe:2.3:a:aws:aws_advanced_jdbc_wrapper.
Know when AWS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable cache read but requires attacker cache-write foothold plus a viable gadget chain, so AC:H and PR:L; full CIA impact within the app process yields C/I/A:H and S:U.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned.
We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.
Articles & Coverage 1
Executive ViewAI
AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 contain an arbitrary code execution vulnerability in the RemoteQueryCachePlugin's unsafe deserialization of cached query results from Redis or Valkey. Any actor with write access to these cache systems can inject malicious payloads that execute on all application servers reading the cache, creating enterprise-wide risk from a single compromised cache entry.
Apply vendor patch. Interim: Restrict write access to Redis/Valkey instances to authorized applications and services; implement network segmentation isolating cache infrastructure from untrusted networks; enable comprehensive audit logging for all cache write operations; monitor for deserialization errors in application logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attacke
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Exploit-DB