JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks move away from the database in an effectively cached system.
Apache Commons JCS suffers from an unauthenticated Java deserialization vulnerability on its TCP Lateral Cache. The lateral listener deserializes incoming objects through an ObjectInputStream guarded only by a three-prefix class denylist, which is bypassable with widely available gadgets, so a remote attacker who can reach the lateral port can send a crafted object and execute code. On deployments that enable the TCP lateral cache this is unauthenticated remote code execution.