Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ben-manes/caffeine
master @ 3336b0d
2
Fixes
0
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Deserialization of Untrusted Data: 1 prior fix. Scrutinize any change in this area.
caffeine/src/main/java/com/github/benmanes/caffeine/cache/LocalAsyncCache.java: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Deserialization of Untrusted Data: Attackers can bypass deserialization proxy checks by tailoring a serialized class hierarchy stream that omits class descriptor data, potentially leading to remote code execution or inconsistent object states. Declaring readObjectNoData mitigates this by enforcing state initialization constraints.
Insecure Deserialization: Failing to enforce serialization proxies allows adversaries to directly instantiate cache view instances via crafted byte streams, bypassing constructor validations. Implementing serialization writeReplace and readObject protections prevents unauthorized direct deserialization.