The warnings would prepare Java ... code cannot use deep reflection to reassign them at will. One special case—serialization libraries needing to mutate final fields during deserialization ...

The request is used to upload a malicious serialized Java session, which then allows the attacker to trigger deserialization ...

The vulnerability, tracked as CVE-2025-30065, is a deserialization issue (CWE-502) in Parquet’s Java library that allows ... Organizations using Parquet for their big-data and analytics stacks ...