The internal ObjectInputStream.filterCheck method throws NullPointerException in the case where the ObjectInputStream has been subclassed to override the InputStream accesses because the OIS itself has a null input stream. When a subclasses OIS is constructed via the protected no-arg constructor, information about the graph depth, number of references, and bytes in the input stream is not available.