VNX-1066: Missing Serialization Control Element

Field	Value
Rule ID	VNX-1066
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-1066
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	missing-serialization-control serialization java cwe-1066
Source	internal/sast/rules/vnx-1066.rego

Overview

VNX-1066 maps to CWE-1066: Missing Serialization Control Element. Java: a class that declares implements Serializable (or java.io.Serializable, anywhere in its implements list, with the header split across lines) but declares no serialVersionUID field among its own members. Without it the stream identifier is computed from the class shape, so any recompilation or harmless change breaks deserialization of stored data, and the class has no explicit control over its serialized form. Nested classes are judged on their own members: an outer class’s serialVersionUID does not cover a nested Serializable class. Not reported: interfaces, enums and records (whose serialization ignores the field), Externalizable classes, classes that only inherit Serializable through extends (the supertype is not resolved), lookalike names such as SerializableHelper, and comments or string literals.

Why This Matters

This weakness class (Missing Serialization Control Element) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1066 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// FLAGGED: no serialVersionUID
public class Customer implements Serializable {
    private String name;
}

public class Order implements Serializable {
    private static final long serialVersionUID = 1L;
    // FLAGGED: the outer class's UID does not cover the nested class
    public static final class Line implements Comparable<Line>, Serializable { ... }
}

Not flagged: a class with private static final long serialVersionUID, interfaces, enums, records, Externalizable classes, and comments or strings.

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-1066 or a false positive.
2. Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-1066 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-1066: Missing Serialization Control Element
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1066
// nosec vnx-1066

Or record an ignore rule: vulnetix ignore add --rule vnx-1066 --reason "...". See Suppressing findings.