CyberGuard dictionary / Web Application Security
Deserialization Vulnerability
A deserialization vulnerability occurs when an application unsafely reconstructs data or objects from untrusted input.
In simple terms
The application treats outside data as an object it can use, and unsafe handling can trigger unintended behavior.
Technical explanation
Risk depends on format and library: native object formats may invoke code during reconstruction, while other formats may allow type confusion or unauthorized state changes. Prefer simple data formats, strict schemas, and avoiding untrusted native object deserialization.
The risk comes from trusting structured input to reconstruct objects or program state in ways the caller can control. Safer designs parse simple data into an explicit schema and reject unexpected types.
Examples in practice
A service accepts a serialized object in a cookie and rebuilds it with a library that can invoke methods chosen by the input.
A service accepts an opaque serialized cookie and loads it as a native object. The team replaces it with a signed identifier and server-side state, then tests malformed inputs.
Why it matters
Unsafe reconstruction may let an attacker alter application state or execute code.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.