Java : Deserialization of untrusted data

Deserialization of user-controlled objects can lead to arbitrary code execution on the server.

Deserializing objects from a standard thread is insecure, because an attacker can override the contents and cause the application to execute arbitrary code. Even if you check the types after deserialization, the malicious code can already be executed, since it happens during deserialization.