Insecure Deserialization
Insecure deserialization is a vulnerability where an application deserializes untrusted data into objects, letting an attacker tamper with the serialized payload to alter application logic or trigger remote code execution. It occurs when serialized input from an untrusted source is reconstructed without integrity checks.
Insecure deserialization happens when an application takes serialized data (a byte stream or text representing objects) from an untrusted source and reconstructs it into live objects without verifying its integrity. Attackers can craft malicious payloads that, during deserialization, instantiate unexpected object types or invoke callback methods — so-called gadget chains — leading to tampering, denial of service, or full remote code execution.
The risk is highest with native binary serialization formats that can encode arbitrary object graphs and trigger code during reconstruction. Safer designs use plain data formats like JSON with explicit, schema-bound parsing that never instantiates arbitrary types. Where object serialization is required, restrict allowed classes to a strict allowlist and add integrity protection (such as a signature) so tampered payloads are rejected before deserialization.
Tracked as CWE-502 and part of the OWASP Top 10 software-integrity category, insecure deserialization is notoriously severe because a single exploitable sink can hand an attacker code execution. Scanners flag deserialization of data that flows from untrusted input.