Insecure Deserialization

Flaw where untrusted serialized data modifies application logic or executes code on parsing.

Core Principles & Analysis

• Popularized by 2015 research on Java Commons Collections gadget chains.
• Frequently escalates directly to remote code execution.
• Mitigated by signing serialized data and preferring formats like JSON.

Specifications & Metrics

• CVE: CWE-502
• IMPACT: Critical