Skip to content

Remove serialization code from SequencedHashMap#283

Merged
elecharny merged 1 commit into
masterfrom
coheigea/remove-externalizabke
May 15, 2026
Merged

Remove serialization code from SequencedHashMap#283
elecharny merged 1 commit into
masterfrom
coheigea/remove-externalizabke

Conversation

@coheigea
Copy link
Copy Markdown
Contributor

The deserialization code in SequencedHashMap is a security risk:

SequencedHashMap.readExternal() calls in.readObject() for both keys and values without any type restriction, which is a classic gadget-chain deserialization vector. The other readExternal implementations deserialize known types via internal delegation, but are all exposed to any caller that passes an untrusted ObjectInput.

We don't use it in the API or Directory Server so let's just remove it

@coheigea coheigea requested a review from elecharny May 14, 2026 10:23
@elecharny elecharny merged commit 042fabf into master May 15, 2026
3 checks passed
@coheigea coheigea deleted the coheigea/remove-externalizabke branch May 15, 2026 12:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants