Insecure Deserialization
Critical · Injection
OWASP Top 10:2025 (current)
A08:2025 — Software or Data Integrity Failures
Historical Top 10:2021 (not current)
A08:2021 — kept for older reports; use 2025 above.
CWE
CWE-502
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
OWASP A08:2025 · OWASP A08:2021 · CWE-502
Definition
Untrusted data is deserialized into objects/code paths.
Root cause
Accepting serialized blobs from clients.
Affected components
- Java/.NET serializers
- Pickle
- PHP unserialize
Impact
RCE, auth bypass.
Severity
Critical
Safe lab reproduction
PortSwigger / Java deserialization primers
Detection methodology
Unusual gadget chains, deserialization libraries in use.
Evidence examples
- Gadget chain lab write-up
Remediation
Avoid native deserialize of untrusted input; allow-lists; signing.
Secure coding examples
Use safe formats (JSON) with schema validation.
Related CYNARKS lessons & labs
Primary 2025 class: A08:2025 — Software or Data Integrity Failures
Practise related skills in Labs or deepen on Academy library.