CWE-1066 is a serializable data element with no associated serialization method. It concerns teams whose objects get written to disk, caches or message queues.
How it happens
A class is marked serializable, but nothing defines how it should be written. The default behavior may fail or produce output nobody planned.
// Pattern to review: marked serializable, with no control over how
public class Session implements java.io.Serializable {
private String user;
private transient Connection conn;
}
// Better: define the behavior explicitly
private void writeObject(java.io.ObjectOutputStream out) throws java.io.IOException {
out.defaultWriteObject();
}
What an attacker gains
MITRE lists reduced reliability, for example by triggering an exception. If an attacker can reach the code, that reliability problem "might introduce a vulnerability."
How to find it
The record lists no detection methods. Review classes that implement a serialization interface and confirm each has a deliberate serialization method.
How to fix it
Add the serialization method the framework expects, or stop marking the class serializable if it never needs to be.
Quick check
What failure does MITRE give as an example?
An exception, triggered when the missing serialization behavior is exercised.
