PT-2026-54642 · Amazon · Aws Advanced Jdbc Wrapper

Davecramer · Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-14265

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0

Description Deserialization of untrusted data in the RemoteQueryCachePlugin allows an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers. The issue occurs because the RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, which enables gadget chain execution if cache entries are poisoned.

Recommendations Upgrade AWS Advanced JDBC Wrapper to version 4.0.1 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-14265

Affected Products

Aws Advanced Jdbc Wrapper

References · 7

• https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-14265 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-051-aws · Vendor Advisory
• https://github.com/aws/aws-advanced-jdbc-wrapper/security/advisories/GHSA-c5q4-97jw-jggh · Note
• https://twitter.com/CVEnew/status/2072441323706093714 · Twitter Post
• https://twitter.com/infoflowcloud/status/2072442934192947302 · Twitter Post
• https://twitter.com/eyalestrin/status/2072761294982443143 · Twitter Post