Belgium’s CCB issued a warning about a deserialization filter bypass in Apache Log4j2 (log4j-core 2.8.0–2.26.1): the FilteredObjectInputStream allowlist permits java.rmi.MarshalledObject, whose get() call quietly opens a second, unfiltered deserialization of whatever gadget chain is stashed in its opaque byte array.
The result is remote code execution with no CVE assigned and no patch at time of writing.
Pruva’s research explains why this is a trust-boundary subtlety rather than Log4Shell 2.0: exploitation needs a service that actually accepts Java-serialized LogEvents from untrusted networks plus a gadget library like Commons Collections on the classpath, a configuration Apache considers outside its security guarantee, since the in-core serialized socket server was removed after 2.8.2.
The meta-story is messier: the bug report was withdrawn and the researcher’s account deleted within two days, while Apache had already documented the same path weeks earlier as a non-security hardening item.
Everyone got to relive December 2021 for about an afternoon; the bug itself has considerably more modest ambitions.
