CVE-2026-14265

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-051-aws/	Release Notes Vendor Advisory Mitigation
https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1	Release Notes
https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-c5q4-97jw-jggh	Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:amazon:advanced_jdbc_wrapper:*:*:*:*:*:*:*:*

History

25 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) La deserialización de datos no confiables en el RemoteQueryCachePlugin en Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 hasta 4.0.0 podría permitir a un actor con acceso de escritura a la infraestructura de caché compartida ejecutar código arbitrario en servidores de aplicaciones que leen resultados de consultas en caché a través de un objeto Java serializado manipulado. El RemoteQueryCachePlugin utiliza ObjectInputStream sin filtrado de clases al deserializar resultados de consultas en caché de Redis o Valkey, lo que permite la ejecución de cadenas de gadgets cuando las entradas de caché están envenenadas. Recomendamos actualizar a AWS Advanced JDBC Wrapper versión 4.0.1 o posterior.

Information

Published : 2026-07-01 20:17

Updated : 2026-10-25 16:10

NVD link : CVE-2026-14265

Mitre link : CVE-2026-14265

CVE.ORG link : CVE-2026-14265

JSON object : View

Products Affected

amazon

advanced_jdbc_wrapper

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-14265", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14265", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-02T15:27:22.888791Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "AWS", "product": "AWS Advanced JDBC Wrapper", "versions": [{"status": "affected", "version": "3.3.0", "versionType": "custom", "lessThanOrEqual": "4.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-01T20:17:08.087", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-051-aws/", "tags": ["Release Notes", "Vendor Advisory", "Mitigation"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1", "tags": ["Release Notes"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-c5q4-97jw-jggh", "tags": ["Vendor Advisory", "Mitigation"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned.\n\n\n\nWe recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later."}, {"lang": "es", "value": "La deserializaci\u00f3n de datos no confiables en el RemoteQueryCachePlugin en Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 hasta 4.0.0 podr\u00eda permitir a un actor con acceso de escritura a la infraestructura de cach\u00e9 compartida ejecutar c\u00f3digo arbitrario en servidores de aplicaciones que leen resultados de consultas en cach\u00e9 a trav\u00e9s de un objeto Java serializado manipulado. El RemoteQueryCachePlugin utiliza ObjectInputStream sin filtrado de clases al deserializar resultados de consultas en cach\u00e9 de Redis o Valkey, lo que permite la ejecuci\u00f3n de cadenas de gadgets cuando las entradas de cach\u00e9 est\u00e1n envenenadas.\n\nRecomendamos actualizar a AWS Advanced JDBC Wrapper versi\u00f3n 4.0.1 o posterior."}], "lastModified": "2026-10-25T16:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amazon:advanced_jdbc_wrapper:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E5EB7F9-72C1-4F5F-B64B-16A5C59F2181", "versionEndExcluding": "4.0.1", "versionStartIncluding": "3.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}