{"record":{"id":"5f2fd89f4d9032b4","repo":"flowable/flowable-engine","slug":"serialized-objects-are-not-allowed","errorCode":null,"errorMessage":"Serialized objects are not allowed","messagePattern":"Serialized objects are not allowed","errorType":"http","errorClass":"FlowableContentNotSupportedException","httpStatus":415,"severity":"error","filePath":"modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/caze/BaseVariableResource.java","lineNumber":370,"sourceCode":"            }\n\n            if (variableScope != null) {\n                scope = RestVariable.getScopeFromString(variableScope);\n            }\n\n            if (variableType.equals(CmmnRestResponseFactory.BYTE_ARRAY_VARIABLE_TYPE)) {\n                // Use raw bytes as variable value\n                byte[] variableBytes = IOUtils.toByteArray(file.getInputStream());\n                setVariable(instanceId, variableName, variableBytes, scope, isNew, async, variableInterceptor);\n\n            } else if (isSerializableVariableAllowed) {\n                // Try deserializing the object\n                ObjectInputStream stream = new ObjectInputStream(file.getInputStream());\n                Object value = stream.readObject();\n                setVariable(instanceId, variableName, value, scope, isNew, async, variableInterceptor);\n                stream.close();\n            } else {\n                throw new FlowableContentNotSupportedException(\"Serialized objects are not allowed\");\n            }\n\n            RestVariable restVariable = null;\n            \n            if (!async) {\n                restVariable = getVariableFromRequestWithoutAccessCheck(instanceId, variableName, responseVariableType, false);\n                \n                // We are setting the scope because the fetched variable does not have it\n                restVariable.setVariableScope(scope);\n            }\n            \n            return restVariable;\n            \n        } catch (IOException ioe) {\n            throw new FlowableIllegalArgumentException(\"Could not process multipart content\", ioe);\n            \n        } catch (ClassNotFoundException ioe) {\n            throw new FlowableContentNotSupportedException(","sourceCodeStart":352,"sourceCodeEnd":388,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/caze/BaseVariableResource.java#L352-L388","documentation":"Flowable's CMMN REST variable upload rejects request bodies that contain Java-serialized objects. When a binary variable is uploaded via multipart, setBinaryVariable attempts to deserialize the stream with ObjectInputStream; if the part's content type is not application/x-java-serialized-object it refuses to proceed, because deserializing arbitrary bytes is unsafe and unsupported. This guards the REST API against unsafe deserialization of untrusted payloads.","triggerScenarios":"POSTing a binary variable to the CMMN REST variable collection endpoint with a multipart part whose Content-Type is not application/x-java-serialized-object (e.g. application/octet-stream) while the resource expects a serialized object, or sending raw serialized bytes without declaring the java serialized object content type.","commonSituations":"Clients uploading files with a generic content type, HTTP clients that mislabel multipart parts, migration from older Flowable/Activiti REST APIs that accepted arbitrary binary payloads, security-hardened setups where serialized objects were intentionally disallowed.","solutions":["Set the multipart part's Content-Type to application/x-java-serialized-object if you really intend to upload a serialized Java object","Upload the data as a plain binary/file part instead and store it via content/attachment endpoints rather than as a serialized variable","Send simple values as JSON variables (typed with the variable type) instead of serializing them client-side","If the class really is missing or the object should not be serialized, restructure the payload as primitives/JSON-serializable types"],"exampleFix":"// before: part Content-Type: application/octet-stream, body: <serialized java object bytes>\n// after (Java client):\nMultiValueMap<String, Object> body = new LinkedMultiValueMap<>();\nHttpHeaders partHeaders = new HttpHeaders();\npartHeaders.setContentType(MediaType.parseMediaType(\"application/x-java-serialized-object\"));\nHttpEntity<byte[]> part = new HttpEntity<>(serializedBytes, partHeaders);\nbody.add(\"data\", part);","handlingStrategy":"validation","validationCode":"if (!\"application/x-java-serialized-object\".equals(part.getContentType())) {\n    throw new IllegalArgumentException(\"Part must be application/x-java-serialized-object or use a JSON variable instead\");\n}","typeGuard":"boolean isSerializedObjectType(String contentType) {\n    return contentType != null && contentType.startsWith(\"application/x-java-serialized-object\");\n}","tryCatchPattern":"try {\n    postBinaryVariable(name, file);\n} catch (HttpServerErrorException | HttpClientErrorException e) {\n    if (e.getResponseBodyAsString().contains(\"Serialized objects are not allowed\")) {\n        // switch to JSON variable or set correct part content type\n    }\n}","preventionTips":["Prefer JSON-typed variables over Java serialization for REST variables","Always set the part Content-Type explicitly when uploading serialized objects","Check the Flowable REST API docs for accepted variable content types"],"tags":["rest","serialization","content-type","cmmn"],"backgroundTag":"unsupported-argument-type","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}