What Is Insecure Deserialization?
Insecure deserialization is the flaw of turning untrusted serialized data back into live objects without safeguards. Serialization converts objects to a storable byte stream; deserialization rebuilds them. When the input is attacker-controlled and the format can reconstruct arbitrary objects, that rebuilding step can be steered into code execution — one of the harder-to-spot paths to full server compromise.
Why is deserializing untrusted data dangerous?#
Because rich serialization formats do more than carry data — they can instantiate objects and invoke methods as part of rebuilding them. Attackers assemble a gadget chain: a sequence of existing classes whose deserialization side effects combine into something dangerous, like running a command. The application never intended those objects to be created, but the format allowed it.
Untrusted bytes → deserialize → unexpected objects instantiated
→ gadget chain triggers → code executionWhere does it show up?#
| Vector | Example |
|---|---|
| Session data | Serialized objects in a cookie |
| API payloads | Native-format request bodies |
| Caches / queues | Serialized objects passed between services |
| File uploads | Serialized data in uploaded files |
The severity depends on the language and libraries in use — some ecosystems have well-known gadget chains ready to exploit.
How do you prevent it?#
- Do not deserialize untrusted input with object-reconstructing formats — this is the core rule.
- Use plain data formats — JSON parsed into simple structures, validated against a schema.
- Add integrity protection — sign serialized data so tampering is detectable.
- Patch serialization libraries and restrict which types may be deserialized.
Insecure deserialization is untrusted input reaching a powerful interpreter — the same theme as injection. More at the Web Security hub.
Frequently asked questions#
What is insecure deserialization?
Insecure deserialization is when an application converts untrusted serialized data back into objects without safeguards. In languages with rich native serialization, a crafted payload can instantiate unexpected objects and trigger code during or after deserialization — a gadget chain — leading to remote code execution, denial of service, or tampering.
How do you prevent deserialization attacks?
Do not deserialize untrusted data with native, object-reconstructing formats. Prefer simple data formats like JSON with a strict schema, so input becomes plain data structures, not arbitrary objects. If native serialization is unavoidable, add integrity checks (signing) and type allowlists, and keep libraries patched.