diff --git a/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/CommonsBeanutils19PackerTest.java b/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/CommonsBeanutils19PackerTest.java
new file mode 100644
index 00000000..7e3e6aef
--- /dev/null
+++ b/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/CommonsBeanutils19PackerTest.java
@@ -0,0 +1,21 @@
+package com.reajason.javaweb.packer.deserialize.java;
+
+import com.reajason.javaweb.packer.ClassPackerConfig;
+import net.bytebuddy.ByteBuddy;
+import org.junit.jupiter.api.Test;
+
+/**
+ * @author ReaJason
+ * @since 2026/1/4
+ */
+class CommonsBeanutils19PackerTest {
+
+    @Test
+    void test(){
+        byte[] bytes = new ByteBuddy().redefine(EvilClass.class).name("hello.world").make().getBytes();
+        ClassPackerConfig classPackerConfig = new ClassPackerConfig();
+        classPackerConfig.setClassBytes(bytes);
+        System.out.println(new CommonsBeanutils19Packer().pack(classPackerConfig));
+    }
+
+}
\ No newline at end of file
diff --git a/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/EvilClass.java b/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/EvilClass.java
new file mode 100644
index 00000000..7d9cd51c
--- /dev/null
+++ b/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/EvilClass.java
@@ -0,0 +1,25 @@
+package com.reajason.javaweb.packer.deserialize.java;
+
+/**
+ * @author ReaJason
+ * @since 2026/1/4
+ */
+public class EvilClass extends Thread implements Runnable {
+
+    static {
+        new EvilClass().start();
+    }
+
+    @Override
+    public StackTraceElement[] getStackTrace() {
+        return new StackTraceElement[0];
+    }
+
+    @Override
+    public void run() {
+        try {
+            Runtime.getRuntime().exec("touch /tmp/success");
+        } catch (Exception ignored) {
+        }
+    }
+}
diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java
new file mode 100644
index 00000000..5075ca2a
--- /dev/null
+++ b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java
@@ -0,0 +1,45 @@
+package jakarta;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/31
+ */
+public class TestInputStreamServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String one = req.getParameter("one");
+        req.setCharacterEncoding("UTF-8");
+        String body = null;
+        InputStream inputStream = req.getInputStream();
+        StringBuilder bodyBuilder = new StringBuilder();
+        if (one != null) {
+            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+            int b;
+            while ((b = inputStream.read()) != -1) {
+                outputStream.write(b);
+            }
+            bodyBuilder.append(outputStream.toString(StandardCharsets.UTF_8));
+            outputStream.close();
+        } else {
+            byte[] buffer = new byte[1024];
+            int bytesRead;
+            while ((bytesRead = inputStream.read(buffer)) != -1) {
+                bodyBuilder.append(new String(buffer, 0, bytesRead, StandardCharsets.UTF_8));
+            }
+        }
+        body = bodyBuilder.toString();
+        resp.setContentType("text/html; charset=UTF-8");
+        resp.setCharacterEncoding("UTF-8");
+        resp.getWriter().println(body);
+    }
+}
diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java
new file mode 100644
index 00000000..e0c5702f
--- /dev/null
+++ b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java
@@ -0,0 +1,38 @@
+package jakarta;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/31
+ */
+public class TestReaderServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String one = req.getParameter("one");
+        String body = null;
+        BufferedReader reader = req.getReader();
+        StringBuilder bodyBuilder = new StringBuilder();
+        if (one != null) {
+            int c;
+            while ((c = reader.read()) != -1) {
+                bodyBuilder.append((char) c);
+            }
+        } else {
+            String line;
+            while ((line = reader.readLine()) != null) {
+                bodyBuilder.append(line);
+            }
+        }
+        body = bodyBuilder.toString();
+        resp.setContentType("text/html; charset=UTF-8");
+        resp.setCharacterEncoding("UTF-8");
+        resp.getWriter().println(body);
+    }
+}
diff --git a/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml b/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml
index 5d275064..88342ccc 100644
--- a/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml
+++ b/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml
@@ -63,6 +63,24 @@
         <url-pattern>/js</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>reader</servlet-name>
+        <servlet-class>jakarta.TestReaderServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>reader</servlet-name>
+        <url-pattern>/reader</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>inputStream</servlet-name>
+        <servlet-class>jakarta.TestInputStreamServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>inputStream</servlet-name>
+        <url-pattern>/inputStream</url-pattern>
+    </servlet-mapping>
+
     <filter>
         <filter-name>empty</filter-name>
         <filter-class>jakarta.EmptyFilter</filter-class>
diff --git a/vul/vul-webapp/src/main/java/TestInputStreamServlet.java b/vul/vul-webapp/src/main/java/TestInputStreamServlet.java
new file mode 100644
index 00000000..24c91cac
--- /dev/null
+++ b/vul/vul-webapp/src/main/java/TestInputStreamServlet.java
@@ -0,0 +1,41 @@
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/31
+ */
+public class TestInputStreamServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String one = req.getParameter("one");
+        req.setCharacterEncoding("UTF-8");
+        String body = null;
+        InputStream inputStream = req.getInputStream();
+        StringBuilder bodyBuilder = new StringBuilder();
+        if (one != null) {
+            ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
+            int b;
+            while ((b = inputStream.read()) != -1) {
+                outputStream.write(b);
+            }
+            bodyBuilder.append(outputStream.toString("UTF-8"));
+            outputStream.close();
+        } else {
+            byte[] buffer = new byte[1024];
+            int bytesRead;
+            while ((bytesRead = inputStream.read(buffer)) != -1) {
+                bodyBuilder.append(new String(buffer, 0, bytesRead, "UTF-8"));
+            }
+        }
+        body = bodyBuilder.toString();
+        resp.setContentType("text/html; charset=UTF-8");
+        resp.setCharacterEncoding("UTF-8");
+        resp.getWriter().println(body);
+    }
+}
diff --git a/vul/vul-webapp/src/main/java/TestReaderServlet.java b/vul/vul-webapp/src/main/java/TestReaderServlet.java
new file mode 100644
index 00000000..2f02fef8
--- /dev/null
+++ b/vul/vul-webapp/src/main/java/TestReaderServlet.java
@@ -0,0 +1,35 @@
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.BufferedReader;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/12/31
+ */
+public class TestReaderServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String one = req.getParameter("one");
+        String body = null;
+        BufferedReader reader = req.getReader();
+        StringBuilder bodyBuilder = new StringBuilder();
+        if (one != null) {
+            int c;
+            while ((c = reader.read()) != -1) {
+                bodyBuilder.append((char) c);
+            }
+        } else {
+            String line;
+            while ((line = reader.readLine()) != null) {
+                bodyBuilder.append(line);
+            }
+        }
+        body = bodyBuilder.toString();
+        resp.setContentType("text/html; charset=UTF-8");
+        resp.setCharacterEncoding("UTF-8");
+        resp.getWriter().println(body);
+    }
+}
diff --git a/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml b/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml
index 5e36e4f8..10cb2981 100644
--- a/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml
+++ b/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml
@@ -15,7 +15,6 @@
         <url-pattern>/test</url-pattern>
     </servlet-mapping>
 
-    <!-- 用于 JSP 文件上传-->
     <servlet>
         <servlet-name>upload</servlet-name>
         <servlet-class>UploadServlet</servlet-class>
@@ -25,7 +24,6 @@
         <url-pattern>/upload</url-pattern>
     </servlet-mapping>
 
-    <!-- 用于脚本引擎执行 JS -->
     <servlet>
         <servlet-name>js</servlet-name>
         <servlet-class>ScriptEngineServlet</servlet-class>
@@ -35,7 +33,6 @@
         <url-pattern>/js</url-pattern>
     </servlet-mapping>
 
-    <!-- 用于测试 Java 反序列化 -->
     <servlet>
         <servlet-name>java-deserialize</servlet-name>
         <servlet-class>JavaReadObjServlet</servlet-class>
@@ -45,7 +42,6 @@
         <url-pattern>/java_deserialize</url-pattern>
     </servlet-mapping>
 
-    <!-- 用于测试 Java 反序列化 -->
     <servlet>
         <servlet-name>b64</servlet-name>
         <servlet-class>Base64ClassLoaderServlet</servlet-class>
@@ -55,7 +51,6 @@
         <url-pattern>/b64</url-pattern>
     </servlet-mapping>
 
-    <!-- 用于测试 Java 反序列化 -->
     <servlet>
         <servlet-name>biginteger</servlet-name>
         <servlet-class>BigIntegerClassLaoderServlet</servlet-class>
@@ -65,6 +60,24 @@
         <url-pattern>/biginteger</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>reader</servlet-name>
+        <servlet-class>TestReaderServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>reader</servlet-name>
+        <url-pattern>/reader</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>inputStream</servlet-name>
+        <servlet-class>TestInputStreamServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>inputStream</servlet-name>
+        <url-pattern>/inputStream</url-pattern>
+    </servlet-mapping>
+
     <filter>
         <filter-name>godzilla</filter-name>
         <filter-class>EmptyFilter</filter-class>