Zennoxa Shield
Application Security Glossary

Insecure Deserialization

Insecure deserialization is a vulnerability where an application deserializes untrusted data into objects, letting an attacker tamper with the serialized payload to alter application logic or trigger remote code execution. It occurs when serialized input from an untrusted source is reconstructed without integrity checks.

Insecure deserialization happens when an application takes serialized data (a byte stream or text representing objects) from an untrusted source and reconstructs it into live objects without verifying its integrity. Attackers can craft malicious payloads that, during deserialization, instantiate unexpected object types or invoke callback methods — so-called gadget chains — leading to tampering, denial of service, or full remote code execution.

The risk is highest with native binary serialization formats that can encode arbitrary object graphs and trigger code during reconstruction. Safer designs use plain data formats like JSON with explicit, schema-bound parsing that never instantiates arbitrary types. Where object serialization is required, restrict allowed classes to a strict allowlist and add integrity protection (such as a signature) so tampered payloads are rejected before deserialization.

Tracked as CWE-502 and part of the OWASP Top 10 software-integrity category, insecure deserialization is notoriously severe because a single exploitable sink can hand an attacker code execution. Scanners flag deserialization of data that flows from untrusted input.

Frequently asked questions

What is insecure deserialization?
Insecure deserialization is a vulnerability where an application reconstructs objects from untrusted serialized data without integrity checks, letting an attacker tamper with the payload to change logic or trigger remote code execution. It affects any sink that deserializes attacker-influenced input.
How do you prevent insecure deserialization?
Avoid deserializing untrusted data with formats that can instantiate arbitrary object types. Prefer schema-bound data formats like JSON, restrict permitted classes to a strict allowlist, and add integrity protection such as a signature so tampered payloads are rejected before deserialization.
What is a gadget chain in deserialization?
A gadget chain is a sequence of existing classes and their methods that an attacker links together in a crafted serialized payload so that deserializing it produces a harmful effect, such as code execution, without the attacker needing to supply any new code.

Related terms

Insecure Deserialization — Zennoxa Glossary — Zennoxa Shield