New Log4j2 Flaw Exposes Java Applications to Remote Code Execution | The CyberSec Guru
thecybersecguru.com
A newly reported Log4j2 flaw can bypass deserialization protections through Java MarshalledObject, potentially enabling RCE, DoS and malicious log injection

A newly reported flaw can bypass FilteredObjectInputStream protections through java.rmi.MarshalledObject, potentially enabling RCE and DoS in vulnerable environments. Could this become another major Log4j security headache?