Ghost Bits: Java's Hidden Threat Revealed

In a compelling presentation at Black Hat Asia 2026, security researchers Xinyu Bai and Zhihui Chen unveiled a novel threat lurking within the Java ecosystem, which they've termed 'ghost bits'. This vulnerability, stemming from the loss of high-order bits during type casting, has been quietly present in Java for years, largely unnoticed, and can be exploited to bypass security measures like Web Application Firewalls (WAFs) and execute a range of malicious attacks.

Understanding 'Ghost Bits'

The core of their research centers on 'ghost bits', the high-order bits that are silently discarded during type conversions in Java. The researchers demonstrated this phenomenon starting with a simple, common Java operation: converting a character to a byte. They illustrated how a Chinese character, which visually appears as two stacked 'X' characters, transforms into the English letter 'X' after a single conversion, with half of its bits disappearing in the process, the 'ghost bits'.

The discovery was serendipitous, originating from a routine testing session where unusual character mismatches were observed. By meticulously comparing byte-level differences, they uncovered the pattern: during type conversions, such as char-to-byte, eight bits could vanish. This seemingly innocuous data loss, often overlooked by developers, opens the door to significant security risks.

Exploiting Ghost Bits for WAF Bypass and Beyond

Bai and Chen detailed how these 'ghost bits' can be weaponized to mutate traffic codes, enabling bypasses for WAFs and other security products. They showcased several real-world attack scenarios:

• Web Application Firewall (WAF) Bypass: They demonstrated how ghost bits can be used to bypass common WAF rules, allowing malicious payloads to pass through undetected. For instance, certain characters that are blocked by WAFs can be transformed into executable commands after the 'ghost bits' conversion process.
• Class Loaders and Deserialization Vulnerabilities: The research highlighted how ghost bits can be exploited in libraries like Apache Commons Collections (BCEL) to load classes from encoded strings, and in Jackson, a popular JSON library, to manipulate data during deserialization, potentially leading to remote code execution.
• Path Traversal and File Upload Bypass: They illustrated how ghost bits can facilitate path traversal attacks in systems like Tomcat by altering file names during character-to-byte conversions, allowing attackers to bypass file upload restrictions and save malicious files with seemingly harmless names.
• SMTP Injection: A critical vulnerability was found in a Java SMTP SDK where ghost bits in Unicode characters could mutate into control data, allowing attackers to terminate SMTP commands prematurely and hijack email sessions to control the subject, body, and even the session termination. This has significant supply chain implications, as demonstrated by its impact on widely used tools like Jira, Bitbucket, and TeamCity.
• Request Smuggling and Cross-Site Scripting (XSS): The research also extended to vulnerabilities in Apache HTTP Client and the JDK's native HTTP server, where ghost bits could lead to request smuggling and response header injection, ultimately enabling XSS attacks.

The Power of 'Ghost Bits' and the Future of Detection

The presenters emphasized that 'ghost bits' are not limited to a single vulnerability type; they can manifest in various forms, including path traversal, WAF bypasses, and authentication bypasses. The sheer pervasiveness of this issue across the Java ecosystem underscores the need for a systematic approach to detection and mitigation.

To address this, Bai and Chen introduced 'Sequex', an AI-powered tool designed to automatically detect these 'ghost bits' patterns in code. Sequex has already identified numerous exploitable vulnerabilities in open-source projects, showcasing its effectiveness in uncovering hidden security flaws.

The researchers urged the community to remain vigilant, with security researchers encouraged to continue hunting for 'ghost bits', organizations to proactively assess their systems, and developers to be mindful of potential logic flaws in their code. They concluded by emphasizing that this research is just the beginning and invited further collaboration to explore this critical area of application security.