Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

Deserialization of Untrusted Data vulnerabilities

CWE-502 · 12 tracked

Insecure deserialization (CWE-502) is a flaw where an application deserializes untrusted data, letting an attacker craft a payload that executes code or manipulates application state during deserialization.

How it’s exploited

The attacker submits a serialized object crafted so that its reconstruction triggers a “gadget chain” — existing classes whose side effects, when chained, lead to remote code execution.

How to prevent it

Never deserialize untrusted input with a format that can instantiate arbitrary types; prefer data-only formats (JSON with a schema), and use allowlists of permitted classes where object serialization is unavoidable.

Tracked deserialization of untrusted data vulnerabilities

12 CVEs in this class, each with severity, exploit status, EPSS, and remediation.

Frequently asked questions

What is Deserialization of Untrusted Data?
Insecure deserialization (CWE-502) is a flaw where an application deserializes untrusted data, letting an attacker craft a payload that executes code or manipulates application state during deserialization.
How is deserialization of untrusted data exploited?
The attacker submits a serialized object crafted so that its reconstruction triggers a “gadget chain” — existing classes whose side effects, when chained, lead to remote code execution.
How do you prevent deserialization of untrusted data?
Never deserialize untrusted input with a format that can instantiate arbitrary types; prefer data-only formats (JSON with a schema), and use allowlists of permitted classes where object serialization is unavoidable.
How many deserialization of untrusted data vulnerabilities are there?
O3 tracks 12 vulnerabilities classified as CWE-502 (Deserialization of Untrusted Data), each with severity, exploit status, EPSS exploitation probability, and remediation. The full list is below.