Harden `readObject(ObjectInputStream)` method argument checks#4098

Merged

vy merged 13 commits into

SunWeb3Sec:harden-message-deserialization

Jun 12, 2026

Commits on Apr 19, 2026

Harden ObjectArrayMessage deserialization with SerializationUtil.assertFiltered
SunWeb3Sec
committed

Commits on Apr 28, 2026

Commits on Apr 29, 2026

Improve changelog
vy
authored

Commits on May 2, 2026

Commits on May 3, 2026

Route serialization-roundtrip tests through SerialUtil

Sun
authored and
Sun
committed

Commits on May 18, 2026

Merge branch '2.x' into harden-message-deserialization
vy
authored
Allow-list log4j 1.2 classes in SerializationTestHelper on Java 8

Sun
authored and
Sun
committed

Commits on May 19, 2026

Inline log4j 1.2 allow-list as a local variable

Sun
authored and
Sun
committed
Allow-list slf4j Log4jLogger and export util.internal for OSGi

Sun
authored and
Sun
committed

Commits on Jun 12, 2026

Bump @Version of packages changed in this PR to 2.27.0

Sun
authored and
Sun
committed
Narrow the JPMS export of util.internal with @ExportTo

Sun
authored and
Sun
committed