PkgRadar

Maven · repo1.maven.org

io.ebean:ebean-redis

Java Unsafe Deserialize: ObjectInputStream / XStream.fromXML — untrusted deserialization sink.

Why PkgRadar flagged 17.11.0

SeveritySignalEvidence
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · io/ebean/redis/encode/EncodeSerializable.java
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · io/ebean/redis/encode/EncodeManyIdsData.java
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · io/ebean/redis/encode/EncodeBeanData.java
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · io/ebean/redis/RedisCacheFactory.java

Scanned versions

VersionVerdictScoreScanned (UTC)
17.11.0Review152026-06-14

Block this in CI

PkgRadar gates io.ebean:ebean-redis (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem maven io.ebean:[email protected]
Start free — 25 scans / moView full evidence
io.ebean:ebean-redis — Maven security scan | PkgRadar