For some reason the link didnt work for me previously, so I linked to github. The notice can also be found at bugalert.org: https://bugalert.org/content/notices/2022-03-29-spring.html
Looking at Github and uses of SerializationUtils.deserialize this is going to be painful.