apache/dubbo · error · IllegalArgumentException

[Serialization Security] Serialized class {className} is not

Error message

[Serialization Security] Serialized class {className} is not in allow list. Current mode is `STRICT`, will disallow to deserialize it by default. Please add it into security/serialize.allowlist or follow FAQ to configure it.

What it means

In STRICT serialization-check mode, a class being deserialized is neither in the allow list nor matches an allowed prefix, so Dubbo rejects it outright. This is the core anti-deserialization-gadget defense: only explicitly allowed classes may be materialized from the wire.

Source

Thrown at dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java:153

                ch = '.';
            }
            hash ^= ch;
            hash *= MAGIC_PRIME;

            if (Arrays.binarySearch(allowPrefixes, hash) >= 0) {
                return classForName(classLoader, className);
            }
        }

        if (checkStatus == SerializeCheckStatus.STRICT) {
            String msg = "[Serialization Security] Serialized class " + className + " is not in allow list. "
                    + "Current mode is `STRICT`, will disallow to deserialize it by default. "
                    + "Please add it into security/serialize.allowlist or follow FAQ to configure it.";
            if (serializeSecurityManager.getWarnedClasses().add(className)) {
                logger.error(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, "", "", msg);
            }

            throw new IllegalArgumentException(msg);
        }

        hash = MAGIC_HASH_CODE;
        for (int i = 0, typeNameLength = className.length(); i < typeNameLength; ++i) {
            char ch = className.charAt(i);
            if (ch == '$') {
                ch = '.';
            }
            hash ^= ch;
            hash *= MAGIC_PRIME;

            if (Arrays.binarySearch(disAllowPrefixes, hash) >= 0) {
                String msg = "[Serialization Security] Serialized class " + className + " is in disallow list. "
                        + "Current mode is `WARN`, will disallow to deserialize it by default. "
                        + "Please add it into security/serialize.allowlist or follow FAQ to configure it.";
                if (serializeSecurityManager.getWarnedClasses().add(className)) {
                    logger.warn(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, "", "", msg);
                }

View on GitHub (pinned to 3a3043227f)

Solutions

1. Add the class name to META-INF/dubbo/security/serialize.allowlist (or the configured allowlist resource)
2. Widen the allow rule to a package prefix that safely covers the class
3. If the class is genuinely trusted in your deployment, switch checkStatus to WARN via dubbo.application.serialize-check-status=WARN (understand the security trade-off)

Example fix

# before: class com.acme.Order rejected
# after: add to serialize.allowlist
com.acme.Order
com.acme.

// Before deploying, ensure each wire class is in the allowlist file
java.util.List<String> needed = java.util.Arrays.asList("com.acme.Order");
java.util.Set<String> allowed = loadAllowList();
if (!allowed.containsAll(needed)) { /* update serialize.allowlist */ }

// No runtime type guard; guard by config review. Verify with:
// grep -f wire-classes.txt META-INF/dubbo/security/serialize.allowlist

try { /* rpc */ } catch (IllegalArgumentException e) { if (e.getMessage().contains("not in allow list")) { addClassToAllowList(e); } throw e; }

When it happens

Trigger: A consumer/provider receives a serialized object whose class name is not present in security/serialize.allowlist and not covered by an allowed prefix, while checkStatus == SerializeCheckStatus.STRICT.

Common situations: Introducing a new DTO, generic collection element, or nested type not yet allowlisted; STRICT being the default after a Dubbo upgrade; a registry/config pushing unexpected class names.

Related errors

• [Serialization Security] Serialized class {className} has no
• [Serialization Security] Serialized class {className} is in
• buffer srcBytes.length=%d, srcIdx=%d, srcSize=%d, destChars.
• invalid UTF-8.
• type [ ${type} ] is unsupported

AI-assisted analysis of apache/dubbo@3a3043227f (2026-08-14). Data as JSON: /api/errors/473acbeaf8c68b53. Report an issue: GitHub.