Davecramer

**Name of the Vulnerable Software and Affected Versions** AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 **Description** Deserialization of untrusted data in the `RemoteQueryCachePlugin` allows an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers. The issue occurs because the `RemoteQueryCachePlugin` uses `ObjectInputStream` without class filtering when deserializing cached query results from Redis or Valkey, which enables gadget chain execution if cache entries are poisoned. **Recommendations** Upgrade AWS Advanced JDBC Wrapper to version 4.0.1 or later.