Log4j2 Deserialization Flaw Enables Remote Code Execution Risk

A new vulnerability in Apache Log4j2 allows for remote code execution (RCE) through a deserialization bypass involving FilteredObjectInputStream. This issue affects versions 2.11.0 to 2.26.1 when configured to accept Java-serialized LogEvent objects from untrusted sources. Unlike the Log4Shell vulnerability, exploitation requires specific conditions, including legacy application behavior and the presence of a suitable gadget on the JVM. No CVE has been assigned yet, and the vulnerability is not classified as a clear-cut flaw by Apache, which warns against deserializing untrusted data. The finding was initially reported by an AI agent, and its implications are still being evaluated by the security community. Organizations are advised to investigate their use of serialized LogEvent receivers rather than assuming all Log4j2 installations are vulnerable. The situation is evolving, with no official patch or CVE available at this time.

Key Points: • Log4j2 deserialization flaw could lead to RCE under specific conditions. • Affected versions include 2.11.0 to 2.26.1 with unsafe configurations. • No CVE assigned; Apache warns against deserializing untrusted data.