hibernate/hibernate-orm · error · HibernateException

Cannot serialize Session while connected

Error message

Cannot serialize Session while connected

What it means

JdbcCoordinatorImpl.serialize(ObjectOutputStream) refuses to serialize while isReadyForSerialization() is false — i.e., the coordinator's logical connection is still connected (holding a pooled or user-supplied JDBC connection that cannot be carried through Java serialization). The result is a HibernateException telling you an open, connected Session is being serialized.

Source

Thrown at hibernate-core/src/main/java/org/hibernate/engine/jdbc/internal/JdbcCoordinatorImpl.java:497

		return owner;
	}

	@Override
	public JdbcResourceTransaction getResourceLocalTransaction() {
		return logicalConnection.getPhysicalJdbcTransaction();
	}

	/**
	 * JDK serialization hook
	 *
	 * @param oos The stream into which to write our state
	 *
	 * @throws IOException Trouble accessing the stream
	 */
	@Override
	public void serialize(ObjectOutputStream oos) throws IOException {
		if ( !isReadyForSerialization() ) {
			throw new HibernateException( "Cannot serialize Session while connected" );
		}
		oos.writeBoolean( isUserSuppliedConnection );
		logicalConnection.serialize( oos );
	}

	/**
	 * JDK deserialization hook
	 *
	 * @param ois The stream into which to write our state
	 * @param owner The Jdbc Session owner which owns the JdbcCoordinatorImpl to be deserialized.
	 *
	 * @return The deserialized {@code JdbcCoordinatorImpl}
	 *
	 * @throws IOException Trouble accessing the stream
	 * @throws ClassNotFoundException Trouble reading the stream
	 */
	public static JdbcCoordinatorImpl deserialize(ObjectInputStream ois, JdbcSessionOwner owner)
			throws IOException, ClassNotFoundException {

View on GitHub (pinned to fad1729dce)

Solutions

1. Never serialize open Sessions: keep Sessions request-scoped and serialize detached entity data (DTOs) instead
2. If a Session must be serialized, disconnect() it first (reconnect on demand) so the coordinator is ready for serialization
3. Review what you actually put into the HTTP session; replace the Session with a detached entity graph or DTO

Example fix

// before: storing an open session in HTTP session
httpSession.setAttribute("hib", session);

// after: store detached data only
session.flush();
httpSession.setAttribute("data", detachOrDto(entity));

// guard before serializing anything that might hold a Session
if (value instanceof Session s && s.isOpen() && s.isConnected()) {
    throw new IllegalStateException("cannot serialize connected Session; disconnect first");
}

static boolean safeToSerialize(Object o) {
    return !(o instanceof Session s) || !s.isOpen() || !s.isConnected();
}

When it happens

Trigger: Putting an open Session/EntityManager into an HttpSession that gets replicated (Spring Session, container clustering), passivating stateful beans, or any JDK serialization of a connected Session.

Common situations: Storing Hibernate Sessions in HTTP session for 'convenience'; servlet containers with session passivation; migrating from open-session-in-view to serialized stateful designs.

Related errors

• No SessionFactory with uuid [{uuid}] and name [{name}]
• {} is closed
• Unable to deserialize from cached file [%s]
• Cannot lazily initialize collection
• Illegal attempt to associate a collection with two open sess

AI-assisted analysis of hibernate/hibernate-orm@fad1729dce (2026-08-22). Data as JSON: /api/errors/9b6df63e4d220fb1. Report an issue: GitHub.