Description
Gallery
Changelog
Versions
A few weeks ago, a very critical vulnerability allowing arbitrary remote code execution on clients and servers (and therefor even all connected clients on a server) was discovered in many Minecraft mods.
More details on the whole topic as well as a list of all currently known affected mods is available here
All Versions
+ Add Version
[1.5.2] Version 1.5.2 - Hotfix for older Java versions
by dogboy21 on Oct 14, 2026
Download
Notable changes/fixes:
- [Replace remote config url to fix certificate issues](https://github.com/dogboy21/serializationisbad/commit/5c691ead2280343965408b9dd5e616de92692571) (see [#83](https://github.com/dogboy21/serializationisbad/issues/83) for more details)
- [Replace existing old remote config URL with the new one](https://github.com/dogboy21/serializationisbad/commit/15f204be7f4c0e028ca6e8a0443d399b655a49f5)
[1.5] Version 1.5
by dogboy21 on Oct 14, 2026
Download
Notable changes/fixes:
Full changelog: [#76](https://github.com/dogboy21/serializationisbad/pull/76)
- Fixed compatibility issues with newer Fabric versions
- Add support for patching of 3rd party
ObjectInputStreamimplementations - Cache remote config locally so it can be used as a fallback in case the remote config cannot be reached on startup
- The configuration directory is now configurable with the system property
serializationisbad.configdir
Full changelog: [#76](https://github.com/dogboy21/serializationisbad/pull/76)
[1.4] Version 1.4
by dogboy21 on Oct 14, 2026
Download
Notable changes/fixes:
Also includes contributions from [@ThatGamerBlue](https://github.com/ThatGamerBlue) and [@ThePixelbrain](https://github.com/ThePixelbrain), thank you!
Full changelog: [#61](https://github.com/dogboy21/serializationisbad/pull/61)
- Improved compatibility with Forge versions < 1.7 and Fabric servers
- Fixed classloading issues in ModLauncher environments
- Fixed classloading issues in Forge 1.7-1.12 versions when the agent is used
- Added config option to disable the use of the remote config
- Added patching support for
SerializationUtils.deserialize
Also includes contributions from [@ThatGamerBlue](https://github.com/ThatGamerBlue) and [@ThePixelbrain](https://github.com/ThePixelbrain), thank you!
Full changelog: [#61](https://github.com/dogboy21/serializationisbad/pull/61)
