Calling ObjectInputStream.readObject on untrusted data can trigger remote code execution through gadget chains.
Avoid Java native deserialization of untrusted input; use a safe format like JSON with strict schemas.