{"record":{"id":"473acbeaf8c68b53","repo":"apache/dubbo","slug":"serialization-security-serialized-class-classna-473acb","errorCode":null,"errorMessage":"[Serialization Security] Serialized class {className} is not in allow list. Current mode is `STRICT`, will disallow to deserialize it by default. Please add it into security/serialize.allowlist or follow FAQ to configure it.","messagePattern":"\\[Serialization Security\\] Serialized class (.+?) is not in allow list\\. Current mode is `STRICT`, will disallow to deserialize it by default\\. Please add it into security/serialize\\.allowlist or follow FAQ to configure it\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java","lineNumber":153,"sourceCode":"                ch = '.';\n            }\n            hash ^= ch;\n            hash *= MAGIC_PRIME;\n\n            if (Arrays.binarySearch(allowPrefixes, hash) >= 0) {\n                return classForName(classLoader, className);\n            }\n        }\n\n        if (checkStatus == SerializeCheckStatus.STRICT) {\n            String msg = \"[Serialization Security] Serialized class \" + className + \" is not in allow list. \"\n                    + \"Current mode is `STRICT`, will disallow to deserialize it by default. \"\n                    + \"Please add it into security/serialize.allowlist or follow FAQ to configure it.\";\n            if (serializeSecurityManager.getWarnedClasses().add(className)) {\n                logger.error(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, \"\", \"\", msg);\n            }\n\n            throw new IllegalArgumentException(msg);\n        }\n\n        hash = MAGIC_HASH_CODE;\n        for (int i = 0, typeNameLength = className.length(); i < typeNameLength; ++i) {\n            char ch = className.charAt(i);\n            if (ch == '$') {\n                ch = '.';\n            }\n            hash ^= ch;\n            hash *= MAGIC_PRIME;\n\n            if (Arrays.binarySearch(disAllowPrefixes, hash) >= 0) {\n                String msg = \"[Serialization Security] Serialized class \" + className + \" is in disallow list. \"\n                        + \"Current mode is `WARN`, will disallow to deserialize it by default. \"\n                        + \"Please add it into security/serialize.allowlist or follow FAQ to configure it.\";\n                if (serializeSecurityManager.getWarnedClasses().add(className)) {\n                    logger.warn(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, \"\", \"\", msg);\n                }","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/apache/dubbo/blob/3a3043227f5571d25eb2889de5bca22f2914843b/dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java#L135-L171","documentation":"In STRICT serialization-check mode, a class being deserialized is neither in the allow list nor matches an allowed prefix, so Dubbo rejects it outright. This is the core anti-deserialization-gadget defense: only explicitly allowed classes may be materialized from the wire.","triggerScenarios":"A consumer/provider receives a serialized object whose class name is not present in security/serialize.allowlist and not covered by an allowed prefix, while checkStatus == SerializeCheckStatus.STRICT.","commonSituations":"Introducing a new DTO, generic collection element, or nested type not yet allowlisted; STRICT being the default after a Dubbo upgrade; a registry/config pushing unexpected class names.","solutions":["Add the class name to META-INF/dubbo/security/serialize.allowlist (or the configured allowlist resource)","Widen the allow rule to a package prefix that safely covers the class","If the class is genuinely trusted in your deployment, switch checkStatus to WARN via dubbo.application.serialize-check-status=WARN (understand the security trade-off)"],"exampleFix":"# before: class com.acme.Order rejected\n# after: add to serialize.allowlist\ncom.acme.Order\ncom.acme.","handlingStrategy":"validation","validationCode":"// Before deploying, ensure each wire class is in the allowlist file\njava.util.List<String> needed = java.util.Arrays.asList(\"com.acme.Order\");\njava.util.Set<String> allowed = loadAllowList();\nif (!allowed.containsAll(needed)) { /* update serialize.allowlist */ }","typeGuard":"// No runtime type guard; guard by config review. Verify with:\n// grep -f wire-classes.txt META-INF/dubbo/security/serialize.allowlist","tryCatchPattern":"try { /* rpc */ } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"not in allow list\")) { addClassToAllowList(e); } throw e; }","preventionTips":["Maintain an allowlist as part of CI for every wire DTO","Use package-prefix allow entries for stable internal packages"],"tags":["serialization","security","allowlist","deserialization"],"backgroundTag":null,"analyzedSha":"3a3043227f5571d25eb2889de5bca22f2914843b","analyzedAt":"2026-08-14T00:43:19.853Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}