CVE-2026-33439: Openam Application Object Input Stream Unsafe Deserialization
Use of `ApplicationObjectInputStream` for Java deserialization. This class is a plain `ObjectInputStream` subclass with no `resolveClass` override and no class allowlist, so any call to `readObject()` on it with attacker-influenced bytes enables arbitrary class instantiation and RCE via well-known Java deserialization gadget chains (CVE-2026-33439 — bypass o
greprules fetch cve-2026-33439-openam-application-object-input-stream-unsafe-deserialization --engine opengrepDescription
Use of `ApplicationObjectInputStream` for Java deserialization. This class is a plain `ObjectInputStream` subclass with no `resolveClass` override and no class allowlist, so any call to `readObject()` on it with attacker-influenced bytes enables arbitrary class instantiation and RCE via well-known Java deserialization gadget chains (CVE-2026-33439 — bypass o
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.