The security hole is in the design of java serialization. Any class marked serializable (in your code, your included libraries, or the JVM itself) is a potentia

The security hole is in the design of java serialization. Any class marked serializable (in your code, your included libraries, or the JVM itself) is a potential security vulnerability as soon as you use this feature. Mark estimated that over half of JRE/JDK vulnerabilities have been due to Serialization. Recent releases added an opt-in feature to filter which classes are allowed to be deserialized, but there's still a horrible amount of open, unauthenticated network ports that take in serialized java. The programmer trying to get the same failures in a post-serialization world would presumably have to find or build a new system with the same design issues.