The newest Insecure Deserialization resources are on the Insecure Deserialization page. For a reading order instead of a date order, see the Insecure Deserialization learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | Deserialization Attacks: How Exploiting Data Formats Can Break Security beginner 13 min read | Library for understanding deserialization attacks, a critical vulnerability where untrusted serialized data is improperly handled, leading to potential remote code execution, privilege escalation, and data manipulation. It details how serialization converts objects to storable formats and deserialization reconstructs them, highlighting common pitfalls in languages like PHP and Python. The library covers techniques for identifying and manipulating serialized data, including specific methods like `__construct()` and `__destruct()` in PHP, and the risks associated with object injection. |
| 2026-04-10 2026 | DELMIA Apriso Insecure Deserialization Exploited in the Wild (CVE-2025-5086) news 2 min read | Writeup on CVE-2025-5086, an insecure deserialization vulnerability in DELMIA Apriso versions Release 2020 through Release 2025. This flaw, residing in the FlexNetOperationsService.svc WCF service utilizing NetDataContractSerializer, allows remote attackers to achieve arbitrary code execution via a malformed serialized payload. The vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog, necessitating immediate updates to the latest patched version. |
| 2026-04-10 2026 | PayloadsAllTheThings - PHP Deserialization Payloads intermediate 6 min read | Library detailing PHP Object Injection, a vulnerability allowing code execution, SQL injection, and path traversal via improper sanitization of input to `unserialize()`. It covers exploiting magic methods like `__wakeup()` and `__destruct()`, using the `phar://` wrapper, and provides payloads for common frameworks, including examples generated by the `phpggc` tool. The resource also outlines how to identify vulnerable code by searching for `unserialize()` calls and relevant magic methods. |
| 2026-04-10 2026 | Exploiting PHP Deserialization with POP Chains intermediate | Exploiting PHP Deserialization with POP Chains |
| 2026-04-10 2026 | What is PHP Object Injection? An In-Depth Guide beginner 9 min read | Guide on PHP object injection detailing its mechanics, risks, and prevention. It explains how the `unserialize()` function, when used with user-controlled input and existing class definitions, can lead to Remote Code Execution (RCE), data theft, Denial of Service (DoS) attacks, and overall application compromise. The guide includes examples of simple injection and the specific WordPress vulnerability CVE-2022-21663, emphasizing secure coding practices and input validation as key mitigation strategies. |
| 2026-04-10 2026 | PHP Object Injection Research advanced 4 min read | Library for detecting PHP Object Injection vulnerabilities, which occur when user-controlled data is passed to PHP's `unserialize()` function. This can lead to remote code execution via Property-Oriented Programming (POP) chains that leverage magic methods like `__destruct()` and `__wakeup()` to write files, execute code, or perform SQL injection. The library helps identify unsafe calls to `unserialize()` with user input, enabling developers to prevent these high-severity issues. |
| 2026-04-10 2026 | .NET Deserialization Cheat Sheet intermediate 3 min read | Cheatsheet detailing .NET deserialization vulnerabilities, covering tools like `ysoserial.net` and Mandiant's `heyserial`. It highlights exploitable CVEs such as CVE-2021-26857 in Microsoft Exchange Server, and issues related to `BinaryFormatter`, `ViewState`, Managed DCOM, `LosFormatter`, `NetDataContractSerializer`, and `ObjectStateFormatter`. The resource also lists specific .NET types and methods prone to unsafe deserialization. |
| 2026-04-10 2026 | BinaryFormatter Deserialization Security Guide for .NET beginner 4 min read | Guide on .NET BinaryFormatter security, detailing its inherent dangers with deserialization vulnerabilities. It explains how attackers can exploit the `BinaryFormatter.Deserialize` method for denial of service, information disclosure, or remote code execution, and emphasizes that it cannot be made secure. The guide strongly advises against its use, even with trusted data, and recommends safer alternatives provided by .NET, highlighting scenarios where seemingly trusted data can cross trust boundaries and lead to compromise. |
| 2026-04-10 2026 | .NET JSON.NET Deserialization RCE intermediate 1 min read | Library vulnerability in .NET's JSON.NET (Newtonsoft.Json) enabling Remote Code Execution through insecure deserialization settings. When `TypeNameHandling` is not set to `None`, attackers can craft malicious JSON payloads to instantiate arbitrary .NET classes, leading to RCE. Remediation involves disabling `TypeNameHandling`, or implementing a `SerializationBinder` to whitelist allowed types, and validating JSON inputs. → invicti.com |
| 2026-04-10 2026 | Deserialization Bugs in the Wild intermediate | Deserialization Bugs in the Wild |
| 2026-04-10 2026 | Exposing 4 Critical Vulnerabilities in Python Picklescan intermediate 5 min read Python | Library, picklescan, has four critical vulnerabilities, CVE-2025-1716, CVE-2025-1889, CVE-2025-1944, and CVE-2025-1945, that allow arbitrary code execution, bypass malware scanning, and crash the tool when processing Python pickle files, particularly within AI/ML model archives used by platforms like Hugging Face. → sonatype.com |
| 2026-04-10 2026 | Breaking Pickle: RCE Through Python Deserialization intermediate | Breaking Pickle: RCE Through Python Deserialization |
| 2026-04-10 2026 | Pickle Deserialization in ML Pipelines: The RCE That Won't Go Away intermediate 12 min read | Library of Python tools and techniques for mitigating pickle deserialization vulnerabilities in ML pipelines. This library addresses the persistent RCE risk posed by `pickle.loads()`, which can execute arbitrary code during deserialization. It covers exploitation vectors including direct model file loading, supply chain attacks on platforms like HuggingFace, and emerging threats in LLM serving infrastructure such as CVE-2025-32444 in vLLM and CVE-2026-26220 in LightLLM, where untrusted data is deserialized over network sockets. |
| 2026-04-10 2026 | Insecure Deserialization Tutorial and Examples beginner 9 min read | Tutorial on insecure deserialization, demonstrating attacks on a video game API by manipulating serialized Java objects. It covers understanding serialization, using tools like `jdeserialize` and `hexdump` to modify payloads, achieving state manipulation by changing item quantities, and ultimately performing remote code execution by leveraging gadget classes within Java frameworks. The tutorial emphasizes that relying on obscurity for security is ineffective and stresses the importance of robust input validation. |
| 2026-04-10 2026 | An In-depth Study of Java Deserialization RCE Exploits advanced | An In-depth Study of Java Deserialization RCE Exploits → dl.acm.org |
| 2026-04-10 2026 | OWASP Deserialization Cheat Sheet beginner 11 min read | Reference for safely deserializing untrusted data, this OWASP cheat sheet details vulnerabilities and mitigation techniques across PHP, Python, and Java. It covers identifying insecure usage of functions like `unserialize()` and `pickle.loads()`, and advises on hardening Java's `ObjectInputStream` through subclassing or agents, mentioning libraries like SerialKiller and NibbleSec. The guide emphasizes using safe interchange formats like JSON and protecting sensitive data by declaring fields as `transient`. → cheatsheetseries.owasp.org |
| 2026-04-10 2026 | Deserialization Vulnerabilities in Java beginner 4 min read | Tutorial detailing Java deserialization vulnerabilities, explaining attack vectors involving reflection and gadget chains, exemplified by `ysoserial`. It covers implications like remote command execution and data theft, and offers best practices including keeping libraries updated, verifying input sources, and consulting OWASP cheat sheets for prevention. |
| 2026-04-10 2026 | Java Deserialization Cheat Sheet intermediate 10 min read | Cheatsheet detailing Java deserialization vulnerabilities across numerous JVM serialization libraries including Java Native, XMLEncoder, XStream, Kryo, Hessian/Burlap, Castor, json-io, Jackson, Fastjson, Genson, Flexjson, Jodd, Red5 IO AMF, Apache Flex BlazeDS, Flamingo AMF, GraniteDS, WebORB for Java, SnakeYAML, jYAML, and YamlBeans. It covers exploitation techniques, specific CVEs such as CVE-2015-4852, CVE-2017-3248, and CVE-2018-2628, and mentions tools like ysoserial payloads and Burp Suite integration. |
| 2026-04-10 2026 | Insecure Deserialization in Web Applications beginner 4 min read | Library detailing insecure deserialization vulnerabilities in web applications and APIs. It explains the concepts of serialization and deserialization, highlighting risks associated with trusting unvalidated data. The entry specifically mentions Java deserialization with gadget chains and PHP's `unserialize` function, as well as Python's `pickle` module. Consequences like remote code execution and authentication bypass are discussed, along with mitigation strategies including input validation and dynamic application security testing (DAST). → invicti.com |
| 2026-04-10 2026 | CVE-2026-25769: Wazuh Critical RCE via Unsafe Deserialization news 9 min read | Writeup on CVE-2026-25769, a critical RCE vulnerability in Wazuh versions 4.0.0 through 4.14.2. The issue stems from unsafe JSON deserialization within the cluster communication mechanism, allowing an attacker controlling a worker node to import arbitrary Python modules and execute commands on the master node with full cluster compromise. This flaw exploits CWE-502 by treating untrusted input as executable code, bypassing validation and relying on an overly permissive trust model between worker and master nodes. → resecurity.com |
| 2026-04-06 2026 | Remote Code Execution (RCE) Prevention - SecPortal beginner | Remote Code Execution (RCE) Prevention - SecPortal |
| 2026-04-06 2026 | CVE-2025-12305: Shiyi-blog RCE via Deserialization news 3 min read | Writeup of CVE-2025-12305 detailing an insecure deserialization vulnerability in quequnlong shiyi-blog versions up to 1.2.1. Exploitation of the Job Handler component, specifically SysJobController.java, allows remote attackers to achieve arbitrary code execution via crafted serialized Java objects. The vulnerability stems from CWE-502 and CWE-20, enabling attackers with low privileges to leverage gadget chains. Public exploits are available, increasing the risk. Mitigation strategies include input validation, serialization filtering, and network segmentation. → sentinelone.com |
| 2026-04-06 2026 | CVE-2025-34153: Hyland OnBase RCE via Deserialization news 3 min read | Writeup on CVE-2025-34153, a critical unauthenticated remote code execution vulnerability in Hyland OnBase. Exploiting the .NET Timer Service's TCP channel on port 6031, attackers can leverage insecure .NET BinaryFormatter deserialization in Hyland.Core.Timers.dll to achieve SYSTEM-level privileges. Detection involves monitoring network traffic to port 6031 and suspicious process activity, while mitigation requires upgrading to version 17.0.2.87 or later, or blocking the port. → sentinelone.com |
| 2026-04-06 2026 | CVE-2025-42928: SAP jConnect RCE via Deserialization news 4 min read | Writeup of CVE-2025-42928, an insecure deserialization vulnerability in SAP jConnect. This flaw, classified under CWE-502, allows authenticated attackers with high privileges to achieve remote code execution by submitting specially crafted serialized Java objects. Exploitation requires leveraging gadget chains within the application's classpath, potentially leading to full system compromise. Mitigation involves applying SAP Security Note #3685286, restricting high-privilege access, and implementing network segmentation. → sentinelone.com |
| 2026-04-06 2026 | Insecure Deserialization Guide - SecPortal beginner | Insecure Deserialization Guide - SecPortal |
| 2026-04-03 2026 | Unsafe Deserialization in Ruby | SecureFlag intermediate | Unsafe Deserialization in Ruby | SecureFlag |
| 2026-04-03 2026 | Analyzing Prerequisites of Known Deserialization Vulnerabilities on Java Applications advanced | Analyzing Prerequisites of Known Deserialization Vulnerabilities on Java Applications → dl.acm.org |
| 2026-04-03 2026 | Insecure Deserialization: The Vulnerability That Gives Attackers RCE beginner 4 min read | Library covering insecure deserialization vulnerabilities, highlighting its potential for Remote Code Execution (RCE) as seen in CVE-2015-4852 (Apache Commons Collections) and issues with Python's `pickle` and PHP's `unserialize()`. It details how gadget chains exploit legitimate class methods for code execution and recommends architectural fixes like using JSON or MessagePack, signing serialized data with HMAC, and implementing Java serialization filters to prevent attackers from controlling serialized bytes and triggering arbitrary code execution. |
| 2026-04-03 2026 | Lab: Exploiting Ruby Deserialization Using a Documented Gadget Chain | PortSwigger intermediate | Library for exploiting Ruby deserialization vulnerabilities, specifically in Ruby on Rails applications. This resource details a lab environment where a documented gadget chain can be adapted to achieve remote code execution. The objective involves creating a malicious serialized object containing an RCE payload to delete a target file, leveraging a serialization-based session mechanism. → portswigger.net |
| 2026-04-03 2026 | Ruby 2.x Universal RCE Deserialization Gadget Chain | elttam advanced 11 min read | Library for universal RCE deserialization in Ruby 2.x, detailing exploitation techniques. This resource describes how to achieve arbitrary command execution by discovering and chaining available gadgets from the standard library, overcoming limitations of previous methods that required specific gems like ActiveSupport and ERB. It covers identifying gadgets that can dynamically load other libraries, including those that partially control the `require` argument, to expand the attack surface and execute system commands. → elttam.com |
| 2026-04-03 2026 | Insecure Deserialization Explained with Examples beginner 11 min read | Library for learning about and exploiting insecure deserialization vulnerabilities. It provides detailed explanations and code examples for PHP object injection (including Phar deserialization), Python pickle deserialization, and Java deserialization. The library covers vulnerability definitions, impact, real-world CVE examples, exploitation techniques using custom code, and mitigation strategies, with exercises in OWASP WebGoat and real-world bug bounty report analysis. |
| 2026-04-03 2026 | Now You Serial, Now You Don't — Systematically Hunting for Deserialization Exploits | Google Cloud advanced 16 min read | Library for hunting deserialization exploits, featuring tools like HeySerial.py for rule generation and CheckYoself.py for validation. This resource details the systematic research process used to develop these tools, enabling the detection of exploitation attempts against vulnerabilities in Exchange (CVE-2021-42321), Zoho ManageEngine (CVE-2020-10189), Jira (CVE-2020-36239), Telerik (CVE-2019-18935), Jenkins (CVE-2016-9299), and log4j (CVE-2021-44228), by identifying gadget chains and malicious payloads. → cloud.google.com |
| 2026-04-03 2026 | PayloadsAllTheThings - Java Deserialization Payloads intermediate 5 min read | Library cataloging Java deserialization payloads and exploitation techniques. It details common vulnerabilities such as those found in Jackson (CVE-2017-7525, CVE-2017-17485, CVE-2019-12384, CVE-2020-36180, CVE-2020-9548) and SnakeYAML, alongside JSF ViewState exploits. The resource lists numerous tools like ysoserial, marshalsec, and Burp extensions for generating and detecting these insecure deserialization issues. |
| 2026-04-03 2026 | Insecure Deserialization | OWASP beginner 3 min read | Reference on Insecure Deserialization, a vulnerability that allows attackers to execute code or manipulate objects by abusing an application's deserialization process with untrusted data. This vulnerability can lead to remote code execution, denial-of-service, and privilege escalation. Mitigations include avoiding deserialization of untrusted data, implementing integrity checks, enforcing strict type constraints, isolating deserialization code, logging exceptions, monitoring the process, and using alternative formats like JSON. → owasp.org |
| 2026-04-03 2026 | Exploiting Insecure Deserialization Vulnerabilities | PortSwigger intermediate 17 min read | Library for exploiting insecure deserialization vulnerabilities in PHP, Ruby, and Java. It covers identifying serialized data, modifying object attributes and data types for attacks, and chaining method invocations. The resource demonstrates how to exploit PHP's `serialize()`/`unserialize()` and Java's `java.io.Serializable` interface, including scenarios involving type juggling with PHP's loose comparison operator. → portswigger.net |
| 2026-01-16 2026 | Introduction to Deserialization Attacks beginner 9 min read | Walkthrough of deserialization attacks, covering serialization basics in Python with `pickle` and PHP with `serialize`. It details how untrusted input during deserialization can lead to critical vulnerabilities like remote code execution (RCE) by loading unexpected classes or executing dangerous code paths. The entry includes a Python Flask application demonstration showcasing the process and the associated risks. |
| 2023-06-06 2023 | Reversing Pickles with r2pickledec intermediate 10 min read Python | Tool for reversing Python pickles with Radare2, r2pickledec supports all instructions up to protocol 5. It enables analysis of serialized Python objects, which are known to be dangerous and can lead to remote code execution if unpickled from untrusted sources. The tool helps in understanding pickle assembly language and reversing real-world pickle files found on compromised systems, aiding in security assessments by identifying potentially malicious data structures and configurations. → blog.doyensec.com |
| 2021-06-11 2021 | Insecure DeserializationWeb ChallengesPart 1 intermediate | This content, "Insecure Deserialization Web Challenges Part 1," likely presents a set of practical exercises focused on identifying and exploiting vulnerabilities related to insecure deserialization in web applications. Participants would engage with pre-configured environments or code snippets to understand the risks associated with improperly handling serialized data, potentially leading to remote code execution or other security compromises. The challenges are designed to build hands-on skills in detecting and mitigating such vulnerabilities. |
| 2020-06-29 2020 | Insecure deserialization | Web Security Academy beginner 5 min read | Reference on insecure deserialization detailing its nature, common scenarios, and exploitation techniques across PHP, Ruby, and Java. It covers how user-controllable data manipulation during deserialization can lead to severe attacks, including object injection, privilege escalation, and remote code execution, while emphasizing the difficulty of secure deserialization and advocating for avoidance or strict pre-deserialization integrity checks. → portswigger.net |