We are using hibernate jpa in combination with spring webflow and when the hibernate session gets de-serialized we get nullpointers due to the exceptionmapper being null.

The problem seems to be situated in org.hibernate.internal.SessionImpl readObject method which doesn't restore the exceptionMapper field. It looks like there may be other fields not being restored better pass this in review.

What about sessionOwner field? Should it not be restored?

Possibly this is a bug due to the way jpa and hibernate are integrated. (non standard)
However just looking at the source code seems like the transient fields should be restored in the readObject method
Alternatively the session shouldn't be serializable but I think that will break much more since third parties probably rely on this feature...