Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
sofastack/sofa-hessian
master @ 54bc965
4
Fixes
0
CVEs
CRITICAL
Peak severity
Highlights
Deserialization of Untrusted Data: 2 prior fixes. Scrutinize any change in this area.
SerializerFactory: most-fixed (1 issue). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Unsafe Deserialization: The denylist is highly susceptible to bypasses whenever new Java deserialization gadgets (such as TemplatesImpl or JNDI vectors) are identified, requiring ongoing manual list updates to maintain security boundaries.
Deserialization of Untrusted Data: Bypasses in how the factory resolves class names, such as wrapping blocked types in array structures, can allow malicious classes to skip denylist verification during deserializer lookup.
Insecure Deserialization: Omissions of standard JDK or third-party library gadgets in the static denylist configuration leave the system exposed to Remote Code Execution (RCE) via standard Java object input streams.