    public static void serializeToStream(final OutputStream os, final Object payload) throws IOException {
        ObjectOutputStream oos = null;
        try {
            oos = new ObjectOutputStream(os);
            oos.writeObject(payload);
        } finally {
            if (oos != null) {
                try {
                    oos.close();
                } catch (IOException ignore) {
                    // empty catch block
                }
            }
        }
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.