I recently came across a vulnerability which was caused by unsafe deserialization (Java) and the use of the Apache Commons library
commons-beanutils. The ysoserial project references
commons-beanutils 1.9.2, so I thought that there might be a later version with an improvement that breaks the gadget, similar to what was introduced in
commons-collections version 3.2.2. But even in the latest version 1.9.4 the gadget works just perfectly, as everyone can confirm with a small example program.
Is there no fix?