apache/dubbo · error · IllegalArgumentException

[Serialization Security] Serialized class {className} is in

Error message

[Serialization Security] Serialized class {className} is in disallow list. Current mode is `WARN`, will disallow to deserialize it by default. Please add it into security/serialize.allowlist or follow FAQ to configure it.

What it means

In WARN mode, a class matched a disallowed prefix using the case-sensitive hash check (disAllowPrefixes). Even though the global mode is WARN, an explicit deny always throws, blocking deserialization of known-dangerous or forbidden classes.

Source

Thrown at dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java:173

        hash = MAGIC_HASH_CODE;
        for (int i = 0, typeNameLength = className.length(); i < typeNameLength; ++i) {
            char ch = className.charAt(i);
            if (ch == '$') {
                ch = '.';
            }
            hash ^= ch;
            hash *= MAGIC_PRIME;

            if (Arrays.binarySearch(disAllowPrefixes, hash) >= 0) {
                String msg = "[Serialization Security] Serialized class " + className + " is in disallow list. "
                        + "Current mode is `WARN`, will disallow to deserialize it by default. "
                        + "Please add it into security/serialize.allowlist or follow FAQ to configure it.";
                if (serializeSecurityManager.getWarnedClasses().add(className)) {
                    logger.warn(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, "", "", msg);
                }

                throw new IllegalArgumentException(msg);
            }
        }

        hash = MAGIC_HASH_CODE;
        for (int i = 0, typeNameLength = className.length(); i < typeNameLength; ++i) {
            char ch = Character.toLowerCase(className.charAt(i));
            if (ch == '$') {
                ch = '.';
            }
            hash ^= ch;
            hash *= MAGIC_PRIME;

            if (Arrays.binarySearch(disAllowPrefixes, hash) >= 0) {
                String msg = "[Serialization Security] Serialized class " + className + " is in disallow list. "
                        + "Current mode is `WARN`, will disallow to deserialize it by default. "
                        + "Please add it into security/serialize.allowlist or follow FAQ to configure it.";
                if (serializeSecurityManager.getWarnedClasses().add(className)) {
                    logger.warn(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, "", "", msg);

View on GitHub (pinned to 3a3043227f)

Solutions

1. Confirm whether the class is legitimately needed; if it is a known gadget class, treat the report as a security incident
2. If the class is safe and matches a deny prefix by accident, rename the package/class or remove the over-broad deny entry
3. Whitelist the specific class in serialize.allowlist so it is accepted before the deny-prefix check (verify your Dubbo version's precedence)

Example fix

# before: com.somebadsuffix.X blocked by deny prefix
# after: add explicit allow
com.somebadsuffix.X

// Validate against known deny prefixes before sending (best-effort):
String denyPrefix = "org.apache.commons.collections.functors.";
if (className.startsWith(denyPrefix)) { /* do not serialize */ }

// n/a — deny evaluation is internal to DefaultSerializeClassChecker

try { /* deserialize */ }
catch (IllegalArgumentException e) { if (e.getMessage().contains("disallow list")) { auditAndDecide(e); } }

When it happens

Trigger: A serialized stream references a class whose name starts with a deny-listed prefix (e.g. a known gadget package) while checkStatus is WARN; the case-sensitive prefix hash matched an entry in disAllowPrefixes.

Common situations: An attacker or misconfigured peer sending gadget-class names; a legitimate class that accidentally collides with a denied prefix; default deny lists shipped with Dubbo blocking a class you intended to use.

Related errors

• [Serialization Security] Serialized class {className} has no
• [Serialization Security] Serialized class {className} is not
• buffer srcBytes.length=%d, srcIdx=%d, srcSize=%d, destChars.
• invalid UTF-8.
• type [ ${type} ] is unsupported

AI-assisted analysis of apache/dubbo@3a3043227f (2026-08-14). Data as JSON: /api/errors/5486b5530d95de5a. Report an issue: GitHub.