Submitting a VariableMap to MessageCorrelationBuilder#setVariables will attempt to deserialize all variables, which fails for object variables that are only present in serialized form. The reason is that MessageCorrelationBuilder internally uses a HashMap to store variables. It should use a VariableMap instead, because the VariableMap implementation avoid deserialization.
Impact: Cannot corelate messages with object values via REST API.
Related forum post: https://groups.google.com/forum/#!topic/camunda-bpm-users/OJ6f-9DL72g
Similar problem with