    public static String serializeToString(final Object payload) throws IOException {
        final ByteArrayOutputStream bos = new ByteArrayOutputStream();
        serializeToStream(bos, payload);
        String agentData = null;
        try {
            agentData = bos.toString("8859_1");
        } catch (UnsupportedEncodingException e) {
            logger.warn("Should always support 8859_1", e);
            agentData = bos.toString();
        }
        return agentData;
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.