HEAD request body processing leading

Hey everyone, I recently discovered and disclosed a CVE involving unauthenticated Java deserialization RCE triggered via an HTTP HEAD request. Root cause summary: The application processes request bodies regardless of HTTP method. A serialized Java object sent inside a HEAD request body is still consumed through request.getInputStream(). The stream is passed into ObjectInputStream.readObject() without filtering or allowlisting.<br/