The vulnerability stems from unsafe deserialization during exception handling in Hessian2. Analysis of advisory details indicates the root cause is in class resolution mechanisms (SerializerFactory) and deserialization entry points (Hessian2Input). These functions would appear in stack traces when: 1) Malicious payloads are deserialized via readObject, and 2) Exception handling triggers additional unsafe deserialization through the factory. The lack of class restrictions in getDeserializer is the primary vulnerability enabler.