SYSLIB0011: BinaryFormatter serialization is obsolete

Due to security vulnerabilities in BinaryFormatter, the following APIs were marked as obsolete in .NET 5. Using them in code generates warning or error SYSLIB0011 at compile time.

• System.Exception.SerializeObjectState
• BinaryFormatter.Serialize
• BinaryFormatter.Deserialize
• Formatter.Serialize(Stream, Object)
• Formatter.Deserialize(Stream)
• IFormatter.Serialize(Stream, Object)
• IFormatter.Deserialize(Stream)

Starting in .NET 8, BinaryFormatter.Serialize and BinaryFormatter.Deserialize throw a NotSupportedException at run time on most project types. In addition, PreserializedResourceWriter.AddBinaryFormattedResource(String, Byte[], String) is obsolete as warning, and the following APIs are obsolete as error:

• System.Runtime.Serialization.Formatter
• System.Runtime.Serialization.IFormatter
• System.Runtime.Serialization.Formatters.Binary.BinaryFormatter

Workarounds

If you're using BinaryFormatter, you should migrate away from it due to its security and reliability flaws. For more information, see Deserialization risks in use of BinaryFormatter and related types and Preferred alternatives.

Suppress a warning

If you must use the obsolete APIs, you can suppress the warning/error in code or in your project file.

To suppress only a single violation, add preprocessor directives to your source file to disable and then re-enable the warning.

// Disable the warning.
#pragma warning disable SYSLIB0011

// Code that uses obsolete API.
// ...

// Re-enable the warning.
#pragma warning restore SYSLIB0011

To suppress all the SYSLIB0011 warnings in your project, add a <NoWarn> property to your project file.

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
   ...
   <NoWarn>$(NoWarn);SYSLIB0011</NoWarn>
  </PropertyGroup>
</Project>

For more information, see Suppress warnings.

See also

• Resolving BinaryFormatter obsoletion and disablement errors
• BinaryFormatter serialization methods are obsolete and prohibited in ASP.NET apps (.NET 5)
• BinaryFormatter serialization APIs produce compiler errors (.NET 7)
• BinaryFormatter disabled across most project types (.NET 8)