Description of the false positive
The Kryo library doesn't correctly track a safe instance of Kryo being passed to KryoPool.Builder.
As an example, this should be considered safe:
private final KryoPool kryoPool = new KryoPool.Builder(this::newKryo).softReferences().build();
private Kryo newKryo() {
Kryo kryo = new Kryo();
kryo.setRegistrationRequired(true);
// ... ect...
return kryo;
}
private T readFromInput(Input input) {
return kryoPool.run(kryo -> kryo.readClassAndObject(input));
}