    public static Object deserialize(final String s) {
        ObjectInputStream ois = null;
        try {
            ois = new ObjectInputStream(new ByteArrayInputStream(s.getBytes("8859_1")));
            return ois.readObject();
        } catch (Exception e) {
            logger.error("Cannot deserialize payload using " + (s == null ? -1 : s.length()) + " bytes", e);
            throw new IllegalArgumentException("Cannot deserialize payload");
        } finally {
            if (ois != null) {
                try {
                    ois.close();
                } catch (IOException ignore) {
                    // empty catch block
                }
            }
        }
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.