Analyzing the Apache Commons Collections LazyMap Deserialization Gadget Chain
Core Mechanism and Call Flow
The sixth widely recognized gadget chain in Apache Commons Collections exploits the interplay between LazyMap and TiedMapEntry to achieve arbitrary code execution during Java object deserialization. Unlike earlier implementations that rely on JDK-specific quirks or dynamic proxies, this path leverages standard colle ...
Posted on Mon, 20 Jul 2026 17:08:40 +0000 by tmharrison