{"record":{"id":"5486b5530d95de5a","repo":"apache/dubbo","slug":"serialization-security-serialized-class-classna-5486b5","errorCode":null,"errorMessage":"[Serialization Security] Serialized class {className} is in disallow list. Current mode is `WARN`, will disallow to deserialize it by default. Please add it into security/serialize.allowlist or follow FAQ to configure it.","messagePattern":"\\[Serialization Security\\] Serialized class (.+?) is in disallow list\\. Current mode is `WARN`, will disallow to deserialize it by default\\. Please add it into security/serialize\\.allowlist or follow FAQ to configure it\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java","lineNumber":173,"sourceCode":"\n        hash = MAGIC_HASH_CODE;\n        for (int i = 0, typeNameLength = className.length(); i < typeNameLength; ++i) {\n            char ch = className.charAt(i);\n            if (ch == '$') {\n                ch = '.';\n            }\n            hash ^= ch;\n            hash *= MAGIC_PRIME;\n\n            if (Arrays.binarySearch(disAllowPrefixes, hash) >= 0) {\n                String msg = \"[Serialization Security] Serialized class \" + className + \" is in disallow list. \"\n                        + \"Current mode is `WARN`, will disallow to deserialize it by default. \"\n                        + \"Please add it into security/serialize.allowlist or follow FAQ to configure it.\";\n                if (serializeSecurityManager.getWarnedClasses().add(className)) {\n                    logger.warn(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, \"\", \"\", msg);\n                }\n\n                throw new IllegalArgumentException(msg);\n            }\n        }\n\n        hash = MAGIC_HASH_CODE;\n        for (int i = 0, typeNameLength = className.length(); i < typeNameLength; ++i) {\n            char ch = Character.toLowerCase(className.charAt(i));\n            if (ch == '$') {\n                ch = '.';\n            }\n            hash ^= ch;\n            hash *= MAGIC_PRIME;\n\n            if (Arrays.binarySearch(disAllowPrefixes, hash) >= 0) {\n                String msg = \"[Serialization Security] Serialized class \" + className + \" is in disallow list. \"\n                        + \"Current mode is `WARN`, will disallow to deserialize it by default. \"\n                        + \"Please add it into security/serialize.allowlist or follow FAQ to configure it.\";\n                if (serializeSecurityManager.getWarnedClasses().add(className)) {\n                    logger.warn(PROTOCOL_UNTRUSTED_SERIALIZE_CLASS, \"\", \"\", msg);","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/apache/dubbo/blob/3a3043227f5571d25eb2889de5bca22f2914843b/dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java#L155-L191","documentation":"In WARN mode, a class matched a disallowed prefix using the case-sensitive hash check (disAllowPrefixes). Even though the global mode is WARN, an explicit deny always throws, blocking deserialization of known-dangerous or forbidden classes.","triggerScenarios":"A serialized stream references a class whose name starts with a deny-listed prefix (e.g. a known gadget package) while checkStatus is WARN; the case-sensitive prefix hash matched an entry in disAllowPrefixes.","commonSituations":"An attacker or misconfigured peer sending gadget-class names; a legitimate class that accidentally collides with a denied prefix; default deny lists shipped with Dubbo blocking a class you intended to use.","solutions":["Confirm whether the class is legitimately needed; if it is a known gadget class, treat the report as a security incident","If the class is safe and matches a deny prefix by accident, rename the package/class or remove the over-broad deny entry","Whitelist the specific class in serialize.allowlist so it is accepted before the deny-prefix check (verify your Dubbo version's precedence)"],"exampleFix":"# before: com.somebadsuffix.X blocked by deny prefix\n# after: add explicit allow\ncom.somebadsuffix.X","handlingStrategy":"try-catch","validationCode":"// Validate against known deny prefixes before sending (best-effort):\nString denyPrefix = \"org.apache.commons.collections.functors.\";\nif (className.startsWith(denyPrefix)) { /* do not serialize */ }","typeGuard":"// n/a — deny evaluation is internal to DefaultSerializeClassChecker","tryCatchPattern":"try { /* deserialize */ }\ncatch (IllegalArgumentException e) { if (e.getMessage().contains(\"disallow list\")) { auditAndDecide(e); } }","preventionTips":["Audit the deny list shipped with your Dubbo version","Avoid reusing package names that collide with known gadget packages"],"tags":["serialization","security","denylist","deserialization"],"backgroundTag":null,"analyzedSha":"3a3043227f5571d25eb2889de5bca22f2914843b","analyzedAt":"2026-08-14T00:43:19.853Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}