Deserialization in Java

What is Deserialization?

Deserialization is the reverse of serialization — converting a byte stream back into a Java object. It reconstructs the object's state from the stored bytes.

Basic Deserialization with ObjectInputStream

Run this example to see its output.

Output:

Handling Deserialization Exceptions

Run this example to see its output.

Deserializing Multiple Objects

Run this example to see its output.

Output:

Version Compatibility and Class Evolution

Run this example to see its output.

Security Risks of Deserialization

Deserialization is a known attack vector. Never deserialize untrusted data!

Run this example to see its output.

Real-World Example: Application State Persistence

Run this example to see its output.

Output:

Alternatives to Java Serialization

Run this example to see its output.

Interview Questions

Q1: What is deserialization and how does it reconstruct objects?

Answer: Deserialization reads a byte stream and reconstructs the Java object. It does NOT call the constructor — it uses internal JVM mechanisms to allocate memory and set field values directly from the stream. However, if a non-serializable parent class exists, its no-arg constructor IS called.

Q2: What exceptions can occur during deserialization?

Answer: (1) ClassNotFoundException — class doesn't exist in classpath, (2) InvalidClassException — serialVersionUID mismatch or class structure incompatible, (3) StreamCorruptedException — byte stream is corrupted or not serialized data, (4) EOFException — reached end of stream unexpectedly, (5) OptionalDataException — primitive data where object was expected.

Q3: Why is deserialization considered a security risk?

Answer: Deserializing untrusted data can trigger remote code execution. Attackers craft malicious byte streams that exploit "gadget chains" — sequences of method calls triggered during deserialization that ultimately execute arbitrary code. This has led to major vulnerabilities in Apache Commons, Spring, and other frameworks.

Q4: How do you safely deserialize in Java 9+?

Answer: Use ObjectInputFilter to whitelist allowed classes, limit object graph depth, and restrict byte size. Example: ois.setObjectInputFilter(ObjectInputFilter.Config.createFilter("com.myapp.*;maxdepth=5;!*")). The !* at the end rejects everything not explicitly allowed.

Q5: Does deserialization call the constructor?

Answer: No, not for the serializable class itself. The JVM allocates memory and sets fields directly. However, for the nearest NON-serializable superclass in the hierarchy, the no-arg constructor IS called. This is why non-serializable parents must have an accessible no-arg constructor.

Q6: What happens if you add a new field to a class after serialization?

Answer: If serialVersionUID matches (explicitly declared), deserialization succeeds — the new field gets its default value (null/0/false). If serialVersionUID was auto-generated (not declared), adding a field changes the computed UID, causing InvalidClassException.