ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy


Assessment: Fully addressed.


When the serialised stre…

Two critical vulnerabilities in Java ObjectInputStream deserialization that allow filter bypass. ZDRES-232 enables bypassing accepted classes list via java.lang.reflect.Proxy when TC_PROXYCLASSDESC marker is present. ZDRES-233 allows triggering static initializers of allow-listed classes during deserialization before instance construction. Both issues enable attackers to execute code through side-effecting static initializers in real-world classes. The vulnerabilities affect JDK's ObjectInputStream implementation and have been fully addressed.