Mod SerializationIsBad

SerializationIsBad, a security patch for modded Minecraft

SerializationIsBad is a Forge coremod and Java agent designed to protect Minecraft Java Edition clients and servers from serious vulnerabilities affecting certain mods. These flaws can abuse unsafe Java deserialization in network packets, potentially allowing remote code execution through a connected server or client.

The patch works at runtime by replacing vulnerable uses of Java’s object deserialization with a filtered system that only permits approved classes. It targets known affected mods while limiting compatibility issues and does not add gameplay content. For a safer Minecraft server experience, our BoxToPlay team recommends it when using older or unmaintained modpacks.