{
  "slug": "insecure-deserialization",
  "url": "https://library.infinity8labs.com/insecure-deserialization/",
  "title": "Insecure deserialization",
  "short": "Deserialization",
  "aliases": [
    "Unsafe deserialization",
    "Untrusted object deserialization",
    "Object injection"
  ],
  "summary": "Insecure deserialization occurs when an application reconstructs native objects from attacker-controlled data. Depending on the runtime and available classes, this can change application state, bypass checks, or execute code.",
  "cwe": [
    "CWE-502"
  ],
  "owasp": "A08:2021 Software and Data Integrity Failures",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-502: Deserialization of Untrusted Data",
      "url": "https://cwe.mitre.org/data/definitions/502.html"
    },
    {
      "title": "OWASP Deserialization Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A08:2021 Software and Data Integrity Failures",
      "url": "https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/"
    },
    {
      "title": "PortSwigger Web Security Academy: Insecure deserialization",
      "url": "https://portswigger.net/web-security/deserialization"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/insecure-deserialization/#overview",
    "https://library.infinity8labs.com/insecure-deserialization/#impact",
    "https://library.infinity8labs.com/insecure-deserialization/#examples",
    "https://library.infinity8labs.com/insecure-deserialization/#remediation",
    "https://library.infinity8labs.com/insecure-deserialization/#testing",
    "https://library.infinity8labs.com/insecure-deserialization/#references"
  ]
}