CVE-2020-26945

MyBatis before 3.5.6 mishandles deserialization of object streams.