Insecure Deserialization

web CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

How It Works

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation. Serialization frameworks in languages like Java, PHP, Python, and .NET allow objects to be transformed into byte streams for storage or transmission, then reconstructed later. The vulnerability arises because deserialization can trigger code execution through the object's methods during reconstruction.

Attackers exploit this by crafting malicious serialized payloads containing specially chosen objects that chain together through "gadget chains" — sequences of method calls in existing application libraries. When the application deserializes the attacker's payload, it automatically invokes these methods in sequence, ultimately achieving arbitrary code execution. For example, in Java applications, an attacker might create a serialized object that, when deserialized, triggers a chain through Apache Commons Collections classes, ending in runtime command execution.

The attack typically begins with identifying an endpoint that accepts serialized data — often in cookies, API parameters, or message queue payloads. The attacker then uses tools like ysoserial (Java) or phpggc (PHP) to generate weaponized payloads targeting known gadget chains in the application's dependencies. Because deserialization happens automatically and often before any application logic executes, these attacks frequently bypass authentication and input validation.

Impact

Remote code execution — attackers gain complete control of the server, executing arbitrary system commands
Authentication bypass — deserializing manipulated user/session objects grants unauthorized access without credentials
Privilege escalation — modifying serialized role or permission objects to gain administrative access
Data exfiltration — reading sensitive files or database contents through executed code
Denial of service — crafting objects that consume excessive memory or CPU during deserialization

Real-World Examples

SolarWinds Web Help Desk suffered two separate deserialization vulnerabilities in rapid succession. CVE-2025-40551 allowed unauthenticated attackers to achieve remote code execution by sending malicious serialized Java objects to the application. Even after patching, researchers discovered a second deserialization flaw in the same product, demonstrating how deeply embedded these vulnerabilities can be in application architectures.

Jenkins automation servers have experienced multiple Java deserialization vulnerabilities where attackers exploited the CLI protocol to send crafted objects, gaining full control over build servers. These attacks were particularly severe because Jenkins instances often have extensive network access and stored credentials for deploying applications.

WordPress and other PHP applications have faced attacks through unserialize() vulnerabilities in plugins, where attackers embedded malicious PHP objects in user-controllable data fields. Successful exploitation enabled attackers to install backdoors by writing arbitrary PHP files to the web root.

Mitigation

Avoid deserializing untrusted data entirely — redesign systems to use data-only formats like JSON instead of native serialization
Implement strict allowlists — configure deserialization libraries to only accept explicitly permitted classes, blocking all others
Apply cryptographic signatures — sign serialized data and validate signatures before deserialization to ensure integrity
Use isolated environments — deserialize in sandboxed processes with minimal privileges to contain potential exploitation
Update vulnerable libraries — patch frameworks and remove dependencies with known gadget chains
Monitor deserialization activity — log and alert on deserialization operations, especially from external sources

Recent CVEs (2803)

CVE-2024-53673

EPSS 1% CVSS 9.8

CRITICAL Act Now

A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization Java Insight Remote Support

NVD

CVE-2024-11145

EPSS 1% CVSS 9.3

CRITICAL Act Now

Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Joomla!. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization RCE Easy Folder Listing Pro

NVD GitHub

CVE-2024-11662

EPSS 1% CVSS 5.3

MEDIUM This Month

A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Deserialization

NVD GitHub VulDB

CVE-2024-53915

EPSS 1% CVSS 9.8

CRITICAL Act Now

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.