Java-Based 'Ghost Bits' Attack Vector Exposes Critical Vulnerabilities in Major Libraries and Frameworks

The presentation by security researchers Bash (B1) and Chu (1EUE) from Alibaba Cloud introduces 'ghost bits,' a Java-based attack vector arising from high-order bit truncation during type casting (e.g., char to byte). This phenomenon, observed in routine operations like Unicode-to-byte conversions, enables bypasses of security controls in libraries such as Jackson, Tomcat, and Spring, leading to vulnerabilities like path traversal (CVE-2023-32315), SMTP injection (CVE-20257962), and request smuggling in Apache HTTP Client (HTTPCLIENT-1974). The researchers demonstrated real-world exploits, including email hijacking in Jira 9.12.16 and domain restriction bypasses in Confluence, where Unicode characters mutated into control characters (e.g., %3E → %2E). Tools like Burp Suite revealed the issue during URI encoding tests, while an AI-powered code auditing tool named 'Sequex' automated the detection of ghost bit patterns across open-source projects. The talk highlighted that ghost bits manifest in bitwise operations and casting, affecting frameworks like Openfire, Spring Framework (CVE-2026-21933), and JDK’s HTTP server. Key takeaways emphasized proactive audits, developer vigilance, and mitigation strategies, with Alibaba Cloud already deploying protection rules. The research underscores the systemic risk of overlooked type conversions in Java’s ecosystem.