--- title: Unsafe Java deserialization in... description: A security advisory covers a CVE affecting SerializingHttpMessageConverter in Spring, describing an unsafe Java deserialization flaw that can lead to remote... canonical: https://daily.dev/posts/unsafe-java-deserialization-in-serializinghttpmessageconverter-remote-code-execution-wisjbrluv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution | daily.dev og:description: A security advisory covers a CVE affecting SerializingHttpMessageConverter in Spring, describing an unsafe Java deserialization flaw that can lead to remote... og:url: https://daily.dev/posts/unsafe-java-deserialization-in-serializinghttpmessageconverter-remote-code-execution-wisjbrluv og:image: https://api.daily.dev/og/posts/WisjbrlUv.png og:image:alt: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution **[Spring](https://daily.dev/sources/spring)** · 1 min read · 7 upvotes · 0 comments ## Summary A security advisory covers a CVE affecting SerializingHttpMessageConverter in Spring, describing an unsafe Java deserialization flaw that can lead to remote code execution. The page content itself is largely inaccessible, consisting mainly of a cookie consent notice rather than detailed technical remediation steps. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is there a security vulnerability in Spring's SerializingHttpMessageConverter? Yes, a CVE has been disclosed for SerializingHttpMessageConverter in Spring describing unsafe Java deserialization that can lead to remote code execution. Applications using this HTTP message converter to deserialize Java objects from untrusted input are at risk and should check for a patched version and apply mitigations. _Teams tracking Spring CVEs like this one can follow security advisories on daily.dev to patch before exploitation._ ## Similar posts on daily.dev - [Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference](https://daily.dev/posts/deserialization-allow-list-silently-bypassed-setbeanclassloader-replaces-deserializer-but-mapper-ke-cxhvfsc6w) · Spring · 9 upvotes · 0 comments - [Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check](https://daily.dev/posts/shared-jsr-223-scriptengine-evaluated-concurrently-without-threading-check-vvkhtbqqe) · Spring · 3 upvotes · 0 comments - [foojay – a place for friends of OpenJDK](https://daily.dev/posts/foojay-a-place-for-friends-of-openjdk-rdat3ew2h) · Foojay.io · 1 upvotes · 0 comments - [EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders](https://daily.dev/posts/embeddedheadersjsonmessagemapper-default-gives-wire-peer-full-control-of-messageheaders-pxcmbfa2r) · Spring · 3 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#spring](https://daily.dev/tags/spring) [View this post on daily.dev](https://daily.dev/posts/unsafe-java-deserialization-in-serializinghttpmessageconverter-remote-code-execution-wisjbrluv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution","url":"https://daily.dev/posts/unsafe-java-deserialization-in-serializinghttpmessageconverter-remote-code-execution-wisjbrluv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/unsafe-java-deserialization-in-serializinghttpmessageconverter-remote-code-execution-wisjbrluv"},"datePublished":"2026-08-20T16:42:37.633Z","dateModified":"2026-09-13T21:10:20.766Z","description":"A security advisory covers a CVE affecting SerializingHttpMessageConverter in Spring, describing an unsafe Java deserialization flaw that can lead to remote...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff749d548af41095da8724da8d7ba5f9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff749d548af41095da8724da8d7ba5f9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Spring","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Spring","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/spring","url":"https://daily.dev/sources/spring"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/unsafe-java-deserialization-in-serializinghttpmessageconverter-remote-code-execution-wisjbrluv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,spring","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Spring","item":"https://daily.dev/sources/spring"},{"@type":"ListItem","position":3,"name":"Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/unsafe-java-deserialization-in-serializinghttpmessageconverter-remote-code-execution-wisjbrluv#faq","mainEntity":[{"@type":"Question","name":"Is there a security vulnerability in Spring's SerializingHttpMessageConverter?","acceptedAnswer":{"@type":"Answer","text":"Yes, a CVE has been disclosed for SerializingHttpMessageConverter in Spring describing unsafe Java deserialization that can lead to remote code execution. Applications using this HTTP message converter to deserialize Java objects from untrusted input are at risk and should check for a patched version and apply mitigations. Teams tracking Spring CVEs like this one can follow security advisories on daily.dev to patch before exploitation."}}]} ```