A flaw was found in the way Restlet handled deserialization. Restlet applications which use ObjectRepresentation to map HTTP request data directly to an object will deserialize arbitrary user-provided serialized data. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.