The native execution bug is in the Apache Commons code but the serialization issue is an attack vector that can be exploited if you are too lazy to implement so

The native execution bug is in the Apache Commons code but the serialization issue is an attack vector that can be exploited if you are too lazy to implement some form of white listing. Think about class loading. Does your JVM/classloader implement class unloading? How much memory can I use in your JVM in I cause every single class on your CLASSPATH to load into memory? It would have been nice if ObjectInputStream was abstract and required a subclass that provided a whitelist of classes.