flowable/flowable-engine · error · FlowableContentNotSupportedException

Serialized objects are not allowed

Error message

Serialized objects are not allowed

What it means

Thrown by setBinaryVariable when the uploaded multipart file is not recognized as raw binary data or a serialized object upload the endpoint supports. The binary variable endpoint only accepts raw byte streams; posting a serialized object through the wrong content path triggers this. It protects against deserializing arbitrary content.

Source

Thrown at modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/task/TaskVariableBaseResource.java:191

            RestVariableScope scope = RestVariableScope.LOCAL;
            if (variableScope != null) {
                scope = RestVariable.getScopeFromString(variableScope);
            }

            if (variableType.equals(CmmnRestResponseFactory.BYTE_ARRAY_VARIABLE_TYPE)) {
                // Use raw bytes as variable value
                byte[] variableBytes = IOUtils.toByteArray(file.getInputStream());
                setVariable(task, variableName, variableBytes, scope, isNew);

            } else if (isSerializableVariableAllowed) {
                // Try deserializing the object
                ObjectInputStream stream = new ObjectInputStream(file.getInputStream());
                Object value = stream.readObject();
                setVariable(task, variableName, value, scope, isNew);
                stream.close();

            } else {
                throw new FlowableContentNotSupportedException("Serialized objects are not allowed");
            }

            return getVariableFromRequestWithoutAccessCheck(task, variableName, scope, false);

        } catch (IOException ioe) {
            throw new FlowableIllegalArgumentException("Error getting binary variable", ioe);
        } catch (ClassNotFoundException ioe) {
            throw new FlowableContentNotSupportedException("The provided body contains a serialized object for which the class was not found: " + ioe.getMessage());
        }

    }

    protected RestVariable setSimpleVariable(RestVariable restVariable, Task task, boolean isNew) {
        if (restVariable.getName() == null) {
            throw new FlowableIllegalArgumentException("Variable name is required");
        }

        // Figure out scope, revert to local is omitted

View on GitHub (pinned to d6d39ce1c6)

Solutions

1. Upload raw byte content and use type 'binary'
2. If you need object semantics, serialize the payload to JSON and use the JSON variables endpoint
3. Verify the multipart file field name matches what the endpoint expects (usually 'file')
4. Check the Flowable version's supported binary upload behavior

Example fix

// before: multipart file containing a Java-serialized object, type omitted
// after
curl -F 'file=@data.bin' -F 'type=binary' POST /cmmn-runtime/tasks/{id}/variables/{name}

const isFile = (f) => f && typeof f === 'object' && typeof f.pipe === 'function';
if (!isFile(filePart)) throw new Error('multipart file part is missing or malformed');

const isRawBinaryUpload = (part) => part != null && part.contentType !== 'application/x-java-serialized-object';

try { await uploadBinaryVariable(...) } catch (e) { if (e.status === 415) fallbackToJsonVariable(payload); else throw e; }

When it happens

Trigger: POST to the task binary variable endpoint with multipart content whose scope/type does not qualify for reading via ObjectInputStream — i.e. content that is neither a plain binary upload nor an accepted serialized object upload.

Common situations: Uploading a Java-serialized object to an endpoint configured only for raw binary; content-type negotiation mismatches; clients wrapping the payload in an extra form field.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Serialized objects are not allowed
• Multipart request with file content is required
• File must be of type .app
• Error writing CMMN XML
• Error writing form model response

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/3c1fbe1e0bc7a793. Report an issue: GitHub.