CVE-2026-14265

Name of the Vulnerable Software and Affected Versions AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0

Description Deserialization of untrusted data in the RemoteQueryCachePlugin allows an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers. The issue occurs because the RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, which enables gadget chain execution if cache entries are poisoned.

Recommendations Upgrade AWS Advanced JDBC Wrapper to version 4.0.1 or later.