Verify whether custom marshalling is affected by unmarshalling vulnerability

Verify whether the Java deserialization vulnerability issue affects our marshalling layer. More info, along with ideas for workarounds (if affected), in:

• Vulnerability explained
• Apache Commons message