There&#x27;s two problems with the lookahead approach:<p>1) It only applies to the code you write.  Libraries can still use insecure object serialization under the hood i.e. you can&#x27;t apply this to an built in app server running JMX.<p>2) It doesn&#x27;t account for pathological objects, i.e. a billion laughs attack: <a href="https:&#x2F;&#x2F;gist.github.com&#x2F;coekie&#x2F;a27cc406fc9f3dc7a70d" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;coekie&#x2F;a27cc406fc9f3dc7a70d</a><p>More details here: <a href="https:&#x2F;&#x2F;tersesystems.com&#x2F;2015&#x2F;11&#x2F;08&#x2F;closing-the-open-door-of-java-object-serialization&#x2F;" rel="nofollow">https:&#x2F;&#x2F;tersesystems.com&#x2F;2015&#x2F;11&#x2F;08&#x2F;closing-the-open-door-of...</a>