diff --git a/src/main/java/org/opensearch/commons/authuser/util/Base64Helper.java b/src/main/java/org/opensearch/commons/authuser/util/Base64Helper.java
index 8597682bf..5b6d8dac1 100644
--- a/src/main/java/org/opensearch/commons/authuser/util/Base64Helper.java
+++ b/src/main/java/org/opensearch/commons/authuser/util/Base64Helper.java
@@ -12,6 +12,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InvalidClassException;
+import java.io.ObjectInputFilter;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.ObjectStreamClass;
@@ -79,6 +80,7 @@ public static Serializable deserializeObject(final String string) {
     private final static class SafeObjectInputStream extends ObjectInputStream {
         public SafeObjectInputStream(InputStream in) throws IOException {
             super(in);
+            setObjectInputFilter(ObjectInputFilter.Config.createFilter("maxdepth=10"));
         }
 
         @Override
diff --git a/src/main/java/org/opensearch/commons/authuser/util/SafeSerializationUtils.java b/src/main/java/org/opensearch/commons/authuser/util/SafeSerializationUtils.java
index 4f116a239..b9d3b87ab 100644
--- a/src/main/java/org/opensearch/commons/authuser/util/SafeSerializationUtils.java
+++ b/src/main/java/org/opensearch/commons/authuser/util/SafeSerializationUtils.java
@@ -28,12 +28,7 @@ public final class SafeSerializationUtils {
     private static final Set<Class<?>> SAFE_ASSIGNABLE_FROM_CLASSES = Set
         .of(InetAddress.class, Number.class, Collection.class, Map.class, Enum.class);
 
-    private static final Set<String> SAFE_CLASS_NAMES = Set
-        .of(
-            "org.ldaptive.LdapAttribute$LdapAttributeValues",
-            "com.google.common.collect.ImmutableMap$SerializedForm",
-            "com.google.common.collect.ImmutableBiMap$SerializedForm"
-        );
+    private static final Set<String> SAFE_CLASS_NAMES = Set.of("org.ldaptive.LdapAttribute$LdapAttributeValues");
     static final Map<Class<?>, Boolean> safeClassCache = new ConcurrentHashMap<>();
 
     static boolean isSafeClass(Class<?> cls) {