Those 6 vulnerabilities occur in a very specific situation (all of those must be true): 1. JSON content is sent by an untrusted client 2. Must have one of tho

Those 6 vulnerabilities occur in a very specific situation (all of those must be true): 1. JSON content is sent by an untrusted client 2. Must have one of those libraries in classpath: Logback, HikariCP, commons-dbcp, P6Spy 3. Default typing must be enabled with enableDefaultTyping (very insecure, if your program has this, it's insecure even after this patch) 4. There must be a property with permissive type (such as Object, Serializable, Comparable, Cloneable, and so on)