The RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper deserializes query results stored in Redis or Valkey using ObjectInputStream without class filtering. This omission allows an attacker to inject a crafted serialized Java object that triggers a gadget chain, producing arbitrary code execution on any application server that later reads the poisoned cache entry. The vulnerability is classified as CWE‑502 and compromises the confidentiality and integrity of the affected application.

AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 are impacted. The flaw is activated when an actor can write to the shared Redis or Valkey cache that the plugin uses to store query results. Versions 4.0.1 and later are not affected.

The CVSS score of 7.7 indicates high severity while the EPSS score of less than 1% indicates that exploitation attempts in the wild are rare. The vulnerability is currently not listed in CISA KEV. Exploitation requires write access to the distributed cache; once a poisoned entry is read, any application server that uses the wrapper will execute the injected payload. Thus, the attack vector is limited to adversaries who can influence cache contents rather than general network attackers.