{"record":{"id":"0048f0330b4fe33e","repo":"stanfordnlp/CoreNLP","slug":"specifying-an-inputserializer-other-than-protobufa","errorCode":null,"errorMessage":"Specifying an inputSerializer other than ProtobufAnnotationSerializer is now deprecated for security reasons.  See https://github.com/stanfordnlp/CoreNLP/security/advisories/GHSA-wv35-hv9v-526p  If you have need for a different class, please post about your use case on the CoreNLP github.","messagePattern":"Specifying an inputSerializer other than ProtobufAnnotationSerializer is now deprecated for security reasons\\.  See https://github\\.com/stanfordnlp/CoreNLP/security/advisories/GHSA-wv35-hv9v-526p  If you have need for a different class, please post about your use case on the CoreNLP github\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"src/edu/stanford/nlp/pipeline/StanfordCoreNLPServer.java","lineNumber":337,"sourceCode":"          try {\n            text = URLDecoder.decode(text, encoding);\n          } catch (IllegalArgumentException e) {\n            // ignore decoding errors so that libraries which don't specify a content type might not fail\n          }\n        }\n        // We use to trim. But now we don't. It seems like doing that is illegitimate. text = text.trim();\n\n        // Read the annotation\n        Annotation annotation = new Annotation(text);\n        // Set the date (if provided)\n        if (date != null) {\n          annotation.set(CoreAnnotations.DocDateAnnotation.class, date);\n        }\n        return annotation;\n      case \"serialized\":\n        String inputSerializerName = props.getProperty(\"inputSerializer\", ProtobufAnnotationSerializer.class.getName());\n        if (!inputSerializerName.equals(ProtobufAnnotationSerializer.class.getName())) {\n          throw new IOException(\"Specifying an inputSerializer other than ProtobufAnnotationSerializer is now deprecated for security reasons.  See https://github.com/stanfordnlp/CoreNLP/security/advisories/GHSA-wv35-hv9v-526p  If you have need for a different class, please post about your use case on the CoreNLP github.\");\n        }\n        AnnotationSerializer serializer = new ProtobufAnnotationSerializer();\n        Pair<Annotation, InputStream> pair = serializer.read(httpExchange.getRequestBody());\n        return pair.first;\n      default:\n        throw new IOException(\"Could not parse input format: \" + inputFormat);\n    }\n  }\n\n  private String getContentType(Headers headers) {\n    String contentType = URL_ENCODED;\n    if (headers.containsKey(\"Content-type\")) {\n      contentType = headers.getFirst(\"Content-type\").split(\";\")[0].trim();\n    }\n    return contentType;\n  }\n\n  private String getEncoding(Headers headers) {","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/stanfordnlp/CoreNLP/blob/1b7edd19c4d0d7b1f13a2591425b9b60a0b1af7a/src/edu/stanford/nlp/pipeline/StanfordCoreNLPServer.java#L319-L355","documentation":"Since the GHSA-wv35-hv9v-526p security advisory, StanfordCoreNLPServer only accepts the default ProtobufAnnotationSerializer as inputSerializer. Supplying any other class when POSTing 'serialized' input is rejected with an IOException to block unsafe deserialization of arbitrary classes.","triggerScenarios":"POSTing serialized input to the server with -inputSerializer (or inputSerializer property) set to any class other than edu.stanford.nlp.pipeline.ProtobufAnnotationSerializer, on inputFormat=serialized.","commonSituations":"Upgrading CoreNLP after the security fix while old client configs still set a custom inputSerializer; following outdated tutorials that showed custom serializers; internal tooling that previously deserialized custom Annotation pipelines.","solutions":["Remove the inputSerializer property so the default ProtobufAnnotationSerializer is used","Send text or json inputFormat instead of serialized if you need a custom pipeline format","Post your use case on the CoreNLP GitHub issues as the message suggests if you truly need a custom serializer"],"exampleFix":"// before\nprops.setProperty(\"inputSerializer\", \"com.example.MySerializer\");\n// after\nprops.remove(\"inputSerializer\"); // or send inputFormat=text/json","handlingStrategy":"validation","validationCode":"String ser = props.getProperty(\"inputSerializer\");\nif (ser != null && !\"edu.stanford.nlp.pipeline.ProtobufAnnotationSerializer\".equals(ser)) {\n  props.remove(\"inputSerializer\"); // reject custom serializers post-GHSA-wv35-hv9v-526p\n}","typeGuard":null,"tryCatchPattern":"try {\n  sendSerializedRequest(props);\n} catch (IOException e) {\n  if (e.getMessage().contains(\"deprecated for security reasons\")) {\n    props.remove(\"inputSerializer\");\n    sendSerializedRequest(props);\n  } else throw e;\n}","preventionTips":["Never set inputSerializer on modern CoreNLP versions","Prefer text/json input formats for custom integrations","Track the GHSA-wv35-hv9v-526p advisory when upgrading"],"tags":["security","deserialization","http-server","deprecated"],"backgroundTag":"deprecated-api-usage","analyzedSha":"1b7edd19c4d0d7b1f13a2591425b9b60a0b1af7a","analyzedAt":"2026-09-10T02:24:07.274Z","contentChangedAt":"2026-09-10T02:24:07.274Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}