My Oracle Support Banner

Restricting Incoming Serialized Java Objects to Oracle WebLogic Server - New with WLS PSUs (Doc ID 2421487.1)

Last updated on MARCH 19, 2021

Applies to:

Oracle WebLogic Server - Version 10.3.6 and later
Information in this document applies to any platform.
- This document was released with the WLS PSU for Oct 2018.
- This document is expected to be updated with newer PSU releases. Check back when applying the next PSU and JDK update and look for updates.
- For example, January 2019 has an updated block list and updated serialFilterScope. July 2019 and 2020 added block listed items. New dates will be in bold.


This document provided information to help in restricting incoming serialized Java objects as part of a security best practice or hardening recommendation for Oracle WebLogic Server (WLS).


To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document
 Overview and Security Recommendation
 Restricting Incoming Serialized Java Objects to Oracle WebLogic Server
 JEP 290 JDK Support
 WebLogic Server JEP 290 Default Filter
 Customizing the WebLogic Server JEP 290 Default Filter

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.