CWE-1070 is a serializable, storable data element, such as a field or member, that contains member elements which are not serializable. It matters to anyone persisting or transmitting objects, for example in sessions, caches and queues.
How it happens
A class is marked serializable, and a field inside it points to an object that is not. The code compiles, then fails when the object is written.
// Pattern to avoid: Serializable outer class, non-serializable inner field
public class Job implements java.io.Serializable {
private Thread worker;
}
// Better: mark runtime-only members as transient
public class Job implements java.io.Serializable {
private transient Thread worker;
}
What an attacker gains
MITRE lists reduced reliability. If an attacker can reach the code, the problem "might introduce a vulnerability."
How to find it
The record lists no detection methods. Review serializable classes and check the type of each field. Tests that actually serialize and read back each class catch it quickly.
How to fix it
Make the inner type serializable, mark the member as transient, or store an identifier and rebuild the object afterward.
Quick check
When does this failure show up?
At the moment the object is written, not when the code is compiled.
