{"record":{"id":"b441d8d1efb6dbc5","repo":"eclipse-vertx/vert.x","slug":"class-not-allowed-b441d8","errorCode":null,"errorMessage":"Class not allowed: ","messagePattern":"Class not allowed: ","errorType":"exception","errorClass":"InvalidClassException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/eventbus/impl/codecs/SerializableCodec.java","lineNumber":70,"sourceCode":"  public String name() {\n    return \"serializable\";\n  }\n\n  @Override\n  public byte systemCodecID() {\n    return 17;\n  }\n\n  private class CheckedClassNameObjectInputStream extends ObjectInputStream {\n    CheckedClassNameObjectInputStream(InputStream in) throws IOException {\n      super(in);\n    }\n\n    @Override\n    protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {\n      String name = desc.getName();\n      if (!codecManager.acceptSerializable(name)) {\n        throw new InvalidClassException(\"Class not allowed: \" + name);\n      }\n      return super.resolveClass(desc);\n    }\n  }\n}\n","sourceCodeStart":52,"sourceCodeEnd":76,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/eventbus/impl/codecs/SerializableCodec.java#L52-L76","documentation":"SerializableCodec uses an ObjectInputStream subclass whose resolveClass validates every class encountered during Java deserialization against CodecManager.acceptSerializable. It throws InvalidClassException(\"Class not allowed: ...\") when the stream references a class not on the allowlist, preventing unsafe arbitrary deserialization.","triggerScenarios":"A clustered event bus message with a Serializable body whose class (or a class reachable in its object graph) is missing from the allowed serializable class list on the receiving node.","commonSituations":"Adding a field of a new type to a message class so deserialization touches a class not whitelisted; third-party library types in message payloads; inconsistent allowlist configuration across cluster nodes.","solutions":["Add the offending class to the allowed serializable classes on the receiving node's EventBusOptions/codec configuration.","Keep message payload types simple and ensure all referenced classes are whitelisted on every node.","Switch to an explicit MessageCodec (e.g. buffer/JSON-based) instead of default Java serialization for complex types.","Synchronize the message-model dependency version across all cluster nodes."],"exampleFix":"// before\nnew EventBusOptions().setAllowedSerializableClasses(Set.of(\"com.myapp.A\")); // B referenced inside A\n// after\nnew EventBusOptions().setAllowedSerializableClasses(Set.of(\"com.myapp.A\", \"com.myapp.B\"));","handlingStrategy":"try-catch","validationCode":"// keep an explicit allowlist in sync with your payload graph\nSet<String> allowed = new EventBusOptions().getAllowedSerializableClasses(); // or your configured set\nif (!allowed.contains(\"com.myapp.NewEmbeddedType\")) {\n  throw new IllegalStateException(\"add NewEmbeddedType to the serializable allowlist\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  bus.request(\"addr\", payload);\n} catch (Exception e) {\n  if (e.getCause() instanceof InvalidClassException) {\n    // whitelist the missing class on receiving nodes or switch to a buffer codec\n  }\n}","preventionTips":["Whitelist every class reachable in serialized message graphs on all nodes","Avoid third-party types inside Serializable message payloads","Use a custom buffer/JSON MessageCodec instead of default Java serialization","Keep serialization allowlist configuration in version control, shared by all services"],"tags":["eventbus","codec","deserialization","security","invalid-class"],"backgroundTag":"class-not-found","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}