Definition
Deserialization turns stored or transmitted data back into live objects. It becomes a security problem when the data crossing that boundary is attacker-influenced and the reconstruction process can be steered into behavior the application never intended.
Why this is not a generic CVE
It is tempting to treat this as a library-version issue. The more accurate framing is a trust decision: the server is rebuilding state from input it does not control, and the reconstruction machinery may invoke application code as a side effect. A patched library in an application that still trusts hostile object state has moved the problem, not removed it.
Where it usually appears
- Session or state blobs held in cookies or hidden fields
- Message-queue consumers processing serialized payloads
- Caching layers that store reconstructed objects
- Inter-service payloads assumed to be internal and therefore trusted
- Internet
- Application
- Unsafe Object Processing
- Application Control
- Sensitive System
Each hop validated by successful exploitation
Tags
- deserialization
- code execution
- trust boundary