    public static byte[] serializeToBytes(final Object payload) throws IOException {
        final ByteArrayOutputStream bos = new ByteArrayOutputStream();
        serializeToStream(bos, payload);
        return bos.toByteArray();
    }
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.