This is not a problem specific to Java serialization, a specifc .NET formatter or any specific formats such as JSON, XML or Binary," researchers say.