Analyzing the Apache Commons Collections LazyMap Deserialization Gadget Chain
Core Mechanism and Call Flow
The sixth widely recognized gadget chain in Apache Commons Collections exploits the interplay between LazyMap and TiedMapEntry to achieve arbitrary code execution during Java object deserialization. Unlike earlier implementations that rely on JDK-specific quirks or dynamic proxies, this path leverages standard colle ...
Posted on Mon, 20 Jul 2026 17:08:40 +0000 by tmharrison
Understanding the Commons Collections 1 Deserialization Chain
Environment Setup
The CC1 gadget chain was patched in JDK 8u71 and later. Therefore, we need a JDK version prior to that. This analysis uses JDK 8u66. To obtain the required source files (especially for sun.reflect.annotation.AnnotationInvocationHandler), follow these steps:
Download the vulnerable JDK version from this OpenJDK changeset and e ...
Posted on Tue, 07 Jul 2026 17:25:29 +0000 by mpower