Aws Advanced Jdbc Wrapper
Monthly
Arbitrary code execution in Amazon's AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) arises from the RemoteQueryCachePlugin deserializing cached query results from Redis or Valkey via a raw ObjectInputStream with no class filtering. An actor able to write to the shared cache can poison entries with a crafted serialized Java object, triggering gadget-chain execution on every application server that later reads that cache entry. No public exploit identified at time of analysis; risk is elevated because a single poisoned cache key fans out to all consuming app servers.
Privilege escalation in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL (versions prior to 4.0.1) allows a remote authenticated low-privilege RDS user to gain the privileges of another database user - including rds_superuser - by planting a crafted function that executes when the higher-privileged user connects to the cluster through the affected wrapper. No public exploit identified at time of analysis, and the vendor (Amazon) released a fix in version 4.0.1 on 2026-05-13 that fully qualifies function calls in PostgreSQL topology detection queries to close the search-path attack surface.
XML External Entity (XXE) injection in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper 3.3.0-4.2.0 allows an actor with write access to the shared cache infrastructure to exfiltrate sensitive files - including database credentials and IAM role credentials - from any application host that reads poisoned cached query results. The attack is conditioned on the RemoteQueryCachePlugin being enabled and the application caching XML column types (SQLXML); an adversary with cache write access injects crafted XML containing external entity references into a cached column value, which are resolved when the application deserializes the cached result. Amazon released version 4.3.0 on 2026-07-23 to fix the issue; no public exploit or CISA KEV listing has been identified at time of analysis.
Arbitrary code execution in Amazon's AWS Advanced JDBC Wrapper (versions 3.3.0 through 4.0.0) arises from the RemoteQueryCachePlugin deserializing cached query results from Redis or Valkey via a raw ObjectInputStream with no class filtering. An actor able to write to the shared cache can poison entries with a crafted serialized Java object, triggering gadget-chain execution on every application server that later reads that cache entry. No public exploit identified at time of analysis; risk is elevated because a single poisoned cache key fans out to all consuming app servers.
Privilege escalation in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL (versions prior to 4.0.1) allows a remote authenticated low-privilege RDS user to gain the privileges of another database user - including rds_superuser - by planting a crafted function that executes when the higher-privileged user connects to the cluster through the affected wrapper. No public exploit identified at time of analysis, and the vendor (Amazon) released a fix in version 4.0.1 on 2026-05-13 that fully qualifies function calls in PostgreSQL topology detection queries to close the search-path attack surface.
XML External Entity (XXE) injection in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper 3.3.0-4.2.0 allows an actor with write access to the shared cache infrastructure to exfiltrate sensitive files - including database credentials and IAM role credentials - from any application host that reads poisoned cached query results. The attack is conditioned on the RemoteQueryCachePlugin being enabled and the application caching XML column types (SQLXML); an adversary with cache write access injects crafted XML containing external entity references into a cached column value, which are resolved when the application deserializes the cached result. Amazon released version 4.3.0 on 2026-07-23 to fix the issue; no public exploit or CISA KEV listing has been identified at time of analysis.