This is basically same issue as JBCOMMON-25, but happened in unmarshalling of a replicated http session. The class is deployed in a war file, so WebappClassLoader is responsible for loading it. In this case the allowArraySyntax workaround doesn't work.

In the http session replication scenario, the MarshalledValueInputStream#resolveClass() tries to resolve the array class with WebappClassLoader#loadClass(name) but this call doesn't understand the array syntax form, delegate it to parents, parents don't know about the class and then a ClassNotFoundException raised.

The loadClass() call should be replaced with the Class.forName(name, false, WebappClassLoader) which understands array syntax.

This http session unmarshalling problem basically doesn't happen normally. This never happen once the class is loaded (cached in the class loader). So this is basically very rare situation, either 1) unfortunate timing fail-over immediately after boot or 2) active-hotstandby setup.