1 article on this topic.
A critical, unauthenticated RCE in Alibaba's Fastjson 1.x is being exploited against Spring Boot fat-JAR deployments, and there is still no fixed 1.x release.