Whatever message this page gives is out now! Go check it out!
Serialfilter text file
Last update:
May 18, 2026
What is SerialFilter
The serialFilter file is a Java serialization filtering mechanism that screens and validates incoming streams of serialized Java objects before they are deserialized. This file is used to enumerate the list of disallowed packages. ColdFusion will block any package in this list from insecure deserialization to help prevent security attacks.
How to prevent it
If you’re aware of any package being reported for vulnerability in deserialization, follow the steps:
- Use the serialfilter.txt file in <CF_HOME>/lib to disallow the package, for example, !org.jgroups.**
- Restart ColdFusion.
This mechanism was updated in the following ColdFusion versions to also handle ColdFusion wddx deserialization:
- ColdFusion 2023 Update 1
- ColdFusion 2021 Update 7
- ColdFusion 2018 Update 17
We're glad. Tell us how this page helped.
We're sorry. Can you tell us what didn't work for you?
Share additional feedback to help us improve.
0/255
|
