ModsFinder

SerializationIsBad

by dogboy21

With SerializationIsBad installed, Forge loads a coremod that patches a deserialization flaw in other mods, aimed at blocking remote code execution.

ForgeClient or server, optionalMIT LicenseOpen source1.6.1 – 1.20.4

What it does

The mod is a coremod for Forge that targets a critical vulnerability found in many Minecraft mods, which could let an attacker run injected code on a player's machine or a server. Because one compromised client could reach every other client on a server, the author released the patch as a standalone fix. The mod is published for Forge only, with builds for 1.6.1 – 1.20.4, and the latest Forge file is 1.5.2 for 1.20.4, dated 2024-03-16.

The mod works on either side, and neither side needs it, so it can be added to a client, a server, or both. The code is open source under the MIT License, and the source code, issue tracker and wiki are public.

Key features

  1. Coremod patching

    Changes how the game handles object deserialization so that a known exploit path is closed.

  2. Remote execution guard

    Targets the flaw that let injected code run on both clients and servers.

  3. Covers many mods

    Aims to patch the vulnerability across a wide set of different mods rather than a single one.

Compatibility

Latest build for each game version and loader.

1.20.x5 of 5 versions with builds
1.20.41.5.2
1.20.31.5.2
1.20.21.5.2
1.20.11.5.2
1.201.5.2
1.19.x5 of 5 versions with builds
1.19.41.5.2
1.19.31.5.2
1.19.21.5.2
1.19.11.5.2
1.191.5.2
1.18.x3 of 3 versions with builds
1.18.21.5.2
1.18.11.5.2
1.181.5.2
1.17.x2 of 2 versions with builds
1.16.x6 of 6 versions with builds
1.15.x3 of 3 versions with builds
1.14.x5 of 5 versions with builds
1.13.x3 of 3 versions with builds
1.12.x3 of 3 versions with builds
1.11.x3 of 3 versions with builds
1.10.x3 of 3 versions with builds
1.9.x5 of 5 versions with builds
1.8.x2 of 2 versions with builds
ReleaseBetaAlphaNot available

Only full game releases are shown. This mod publishes no snapshot builds.

20 older game versions (1.6.1 – 1.8.7) not shown. All files on Modrinth

Questions

Does SerializationIsBad have to run on the server?

No. It works on either side, and neither side needs it, so a client, a server, or both can run it.

Which Forge versions does the patch support?

Files are published for Forge across 1.6.1 – 1.20.4, and the latest file is 1.5.2 for 1.20.4.

What the author says

A few weeks ago, a very critical vulnerability allowing arbitrary remote code execution on clients and servers (and therefor even all connected clients on a server) was discovered in many Minecraft mods.
dogboy21, on the Modrinth page

Official listing

Owner
dogboy21
Published
2023-07-30
Updated on Modrinth
2024-03-16
Facts verified
2026-10-15
Open on ModrinthCompare