hypnguyen1209 / log4j2-rce

Pre-auth RCE via FilteredObjectInputStream MarshalledObject bypass in Apache Log4j 2

dinosn / log4j-4255

End-to-end Docker lab reproducing Apache log4j2 #4255 — FilteredObjectInputStream allowlist bypass via java.rmi.MarshalledObject (unfiltered deserialization → RCE) on Log4j 2.26.1 / JDK 17.