The technique bypasses a defensive filter retained for backward compatibility with serialized log streams. Exploitation requires an application to explicitly process attacker-controlled data through Log4j's FilteredObjectInputStream. This implementation approach is not typical of modern Log4j use.

Serialization support is discouraged in Log4j 2.x and removed in Log4j 3.x.