Deserialization turns stored or transmitted data back into objects. When an application deserializes data an attacker can control, using formats such as Java serialization, PHP serialize, Python pickle or .NET formatters, the attacker may be able to run code on the server.

How it happens

The attacker sends a crafted serialized object, often in a cookie, a hidden field or an API body. During deserialization, "gadget" classes that already exist in the application's libraries are chained together to perform actions, up to executing commands.

Why it matters

• Remote code execution.
• Authentication bypass through tampered objects.
• Denial of service.

How to prevent it

• Do not deserialize untrusted data with native serializers; use simple data formats like JSON with a strict schema.
• If you must deserialize, sign the data and verify the signature first.
• Restrict which classes may be deserialized.
• Keep libraries updated to remove known gadget chains.

How Vooki Pro helps

• Tests for insecure deserialization in Java, PHP, Python pickle, .NET, JSON and XML formats.
• Detects outdated frameworks and libraries and maps them to known CVEs from a database of more than 10,000 entries.
• Includes CVE-class checks such as Log4Shell and Spring4Shell.
• Rates each finding by severity and confidence so you can prioritise.

Frequently asked questions

Why does deserialization lead to code execution?

Deserializers can create objects and call their methods. Attackers chain existing library classes (gadgets) to run commands during deserialization.

Is JSON deserialization safe?

Plain JSON with a strict schema is much safer than native object serialization, but polymorphic JSON libraries can still be abused if misconfigured.

Related: JSON Web Token (JWT) vulnerabilities · HTTP request smuggling