While com.sun.faces.context.flash.SessionHelper is a mutable class, it is never mutated after it is first serialized, and thus the distributed session manager can treat this class as immutable.