Insecure deserialization
Summary: PortSwigger Research explains that insecure deserialization occurs when a website deserializes user-controllable data, letting an attacker manipulate serialized objects or substitute an object of an entirely different class, since any class available to the website will be instantiated regardless of which class was expected. The write-up states that many deserialization-based attacks complete before deserialization finishes, and that impact can include remote code execution, privilege escalation, arbitrary file access, and denial-of-service.
Bottom line: The source argues it is not possible to securely deserialize untrusted input, because modern sites carry a web of cross-library dependencies that makes it impractical to plug every gadget chain an attacker could reach.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026