Log4j FilteredObjectInputStream Allowlist Bypass Vulnerability

A vulnerability tracked as WVE-2026-007 affects Apache Log4j versions 2.11.0 through 2.26.1, potentially allowing for Remote Code Execution (RCE). The issue resides in the FilteredObjectInputStream (FOIS), which explicitly allows java.rmi.MarshalledObject. Because MarshalledObject carries its payload as an opaque byte array, the FOIS allowlist fails to inspect the inner content. When the LogEvent is processed, the application automatically unwraps the payload using an unfiltered ObjectInputStream, enabling the execution of arbitrary Java gadget chains.

Technical analysis shows the vulnerability is triggered via Log4jLogEvent.LogEventProxy, which calls marshalledMessage.get() inside its readResolve() process. This effectively circumvents the defense-in-depth allowlisting mechanism. However, exploitation requires a specific and relatively uncommon configuration: the target must be running an exposed serialized log receiver (such as an FOIS-based socket server) and have vulnerable gadget libraries (e.g., Commons-Collections) on the classpath.

While not as universally exploitable as the original Log4Shell, this vulnerability poses a significant risk to organizations using Log4j's serialized log transfer features. Impacted services include official samples like ObjectInputStreamLogEventBridge and legacy deployments using net.server.TcpSocketServer. Organizations should prioritize identifying exposed logging sockets and applying process-wide JDK serialization filters as a primary mitigation.