This weakness occurs when a class or data structure is marked as serializable, but it contains one or more member elements that cannot be serialized. This mismatch prevents the entire object from being properly saved or transmitted.
This issue primarily causes runtime failures, such as `SerializationException` in .NET or `NotSerializableException` in Java, which can crash your application or corrupt data during critical operations like saving state, caching, or remote communication. If an attacker can trigger this code path, these reliability flaws can be exploited to cause denial-of-service, bypass security mechanisms, or lead to unexpected system behavior. To prevent this, ensure all member fields within a serializable class are themselves serializable. Common culprits include file handles, thread objects, database connections, or custom classes missing the serialization marker. Use the `transient` keyword in Java or `[NonSerialized]` attribute in .NET to explicitly exclude non-serializable members if they are not required for the object's stored state.
Impact: Reduce Reliability