{"record":{"id":"141c3b1643e4a10d","repo":"apache/dubbo","slug":"serialization-security-serialized-class-classna","errorCode":null,"errorMessage":"[Serialization Security] Serialized class {className} has not implement Serializable interface. Current mode is strict check, will disallow to deserialize it by default. ","messagePattern":"\\[Serialization Security\\] Serialized class (.+?) has not implement Serializable interface\\. Current mode is strict check, will disallow to deserialize it by default\\. ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java","lineNumber":119,"sourceCode":"\n    /**\n     * Try load class\n     *\n     * @param className class name\n     * @throws IllegalArgumentException if class is blocked\n     */\n    public Class<?> loadClass(ClassLoader classLoader, String className) throws ClassNotFoundException {\n        Class<?> aClass = loadClass0(classLoader, className);\n        if (!aClass.isPrimitive() && !Serializable.class.isAssignableFrom(aClass)) {\n            String msg = \"[Serialization Security] Serialized class \" + className\n                    + \" has not implement Serializable interface. \"\n                    + \"Current mode is strict check, will disallow to deserialize it by default. \";\n            if (serializeSecurityManager.getWarnedClasses().add(className)) {\n                logger.error(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, \"\", \"\", msg);\n            }\n\n            if (checkSerializable) {\n                throw new IllegalArgumentException(msg);\n            }\n        }\n\n        return aClass;\n    }\n\n    private Class<?> loadClass0(ClassLoader classLoader, String className) throws ClassNotFoundException {\n        if (checkStatus == SerializeCheckStatus.DISABLE) {\n            return classForName(classLoader, className);\n        }\n\n        long hash = MAGIC_HASH_CODE;\n        for (int i = 0, typeNameLength = className.length(); i < typeNameLength; ++i) {\n            char ch = className.charAt(i);\n            if (ch == '$') {\n                ch = '.';\n            }\n            hash ^= ch;","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apache/dubbo/blob/3a3043227f5571d25eb2889de5bca22f2914843b/dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java#L101-L137","documentation":"During deserialization class loading, Dubbo detected a class that does not implement java.io.Serializable. With checkSerializable enabled (the strict default), Dubbo refuses to deserialize it to protect against untrusted class instantiation. The message is only thrown when serializeSecurityManager's checkSerializable flag is true.","triggerScenarios":"An RPC payload references a non-Serializable class (no 'implements Serializable' on the class or its hierarchy) while the framework is in strict Serializable-checking mode.","commonSituations":"Sharing a DTO/exception/enum across provider and consumer where the class was never marked Serializable; third-party library objects injected into a payload; upgrading Dubbo to a version that enables checkSerializable by default.","solutions":["Make the offending class (and any nested types) implement java.io.Serializable","If the class is third-party and cannot be changed, set dubbo.application.serialize-check-status to DISABLE or WARN and check-serializable to false","Verify the exact class name from the logged message and audit why it appears in the serialized stream"],"exampleFix":"// before\npublic class MyRequest {\n    private String id;\n}\n// after\npublic class MyRequest implements java.io.Serializable {\n    private static final long serialVersionUID = 1L;\n    private String id;\n}","handlingStrategy":"validation","validationCode":"Class<?> c = MyDto.class;\nif (!java.io.Serializable.class.isAssignableFrom(c)) {\n    // do not send c over RPC; mark it Serializable or exclude it\n}","typeGuard":"static boolean isRpcSafe(Class<?> c) {\n    return java.io.Serializable.class.isAssignableFrom(c);\n}","tryCatchPattern":"try { /* rpc call */ } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"Serializable\")) { /* mark class Serializable */ } }","preventionTips":["Make all DTOs shared over RPC implement Serializable with explicit serialVersionUID","Run a build-time check that wire classes implement Serializable"],"tags":["serialization","security","deserialization"],"backgroundTag":null,"analyzedSha":"3a3043227f5571d25eb2889de5bca22f2914843b","analyzedAt":"2026-08-14T00:43:19.853Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}