Insecure Deserialization
Critical · Injection · OWASP A08:2021 · CWE-502
Description
Untrusted data is deserialized into objects/code paths.
Root cause
Accepting serialized blobs from clients.
Impact
RCE, auth bypass.
Detection
Unusual gadget chains, deserialization libraries in use.
Mitigation
Avoid native deserialize of untrusted input; allow-lists; signing.
Secure coding
Use safe formats (JSON) with schema validation.
Safe lab example
PortSwigger / Java deserialization primers
Practise related skills in Labs or deepen on Academy library.