hibernate/hibernate-orm · error · IllegalArgumentException

The InputStream must not be null

Error message

The InputStream must not be null

What it means

SerializationHelper.doDeserialize — the body behind every deserialize overload — requires a non-null InputStream and fails fast with IllegalArgumentException otherwise, before any classloader resolution or stream-header reading happens. Like its serialize sibling, this is a deliberate argument-contract guard.

Source

Thrown at hibernate-core/src/main/java/org/hibernate/internal/util/SerializationHelper.java:195

	 * @param inputStream the serialized object input stream, must not be null
	 * @param loader The classloader to use
	 *
	 * @return the deserialized object
	 *
	 * @throws IllegalArgumentException if <code>inputStream</code> is <code>null</code>
	 * @throws SerializationException (runtime) if the serialization fails
	 */
	public static Object deserialize(InputStream inputStream, ClassLoader loader) throws SerializationException {
		return doDeserialize( inputStream, loader, defaultClassLoader(), hibernateClassLoader() );
	}

	public static <T> T doDeserialize(
			InputStream inputStream,
			ClassLoader loader,
			ClassLoader fallbackLoader1,
			ClassLoader fallbackLoader2) throws SerializationException {
		if ( inputStream == null ) {
			throw new IllegalArgumentException( "The InputStream must not be null" );
		}

		CORE_LOGGER.trace( "Starting deserialization of object" );

		try ( var in = new CustomObjectInputStream( inputStream, loader, fallbackLoader1, fallbackLoader2 ) ) {
			//noinspection unchecked
			return (T) in.readObject();
		}
		catch (ClassNotFoundException | IOException e) {
			throw new SerializationException( "could not deserialize", e );
		}
	}

	/**
	 * Deserializes an object from an array of bytes using the
	 * Thread Context ClassLoader (TCCL). If there is no TCCL set,
	 * the classloader of the calling class is used.
	 * <p>

View on GitHub (pinned to fad1729dce)

Solutions

1. Ensure a real InputStream is supplied (e.g., new ByteArrayInputStream(bytes)) before calling deserialize.
2. Null-check the stream at your own boundary and throw a contextual error naming the resource that failed to open.

Example fix

// before
InputStream in = openBlobStream(id); // returns null when blob missing
Object o = SerializationHelper.deserialize(in, loader); // IllegalArgumentException

// after
InputStream in = openBlobStream(id);
if (in == null) throw new IllegalStateException("no blob for id " + id);
Object o = SerializationHelper.deserialize(in, loader);

if (inputStream == null) {
    throw new IllegalStateException("no serialized payload available");
}
Object o = SerializationHelper.deserialize(inputStream, loader);

When it happens

Trigger: Calling deserialize(null, loader) or doDeserialize(null, ...), usually because stream acquisition returned null or the byte-to-stream conversion step was skipped.

Common situations: Resource lookups returning null (blob not found, connection closed) passed straight through; test code with placeholder arguments; refactors moving stream opening into a conditional branch.

Related errors

• The OutputStream must not be null
• The byte[] must not be null
• CacheMode cannot be null
• Result class is null
• The specified package name cannot be null

AI-assisted analysis of hibernate/hibernate-orm@fad1729dce (2026-08-22). Data as JSON: /api/errors/e1cdadeb1f8fa4c2. Report an issue: GitHub.