SECURITY GUIDE
Unsafe deserialization
Review the risks of accepting serialized data from untrusted sources and safer ways to handle data formats.
Areas to considerWeb applicationsBackground servicesData exchange
01
THE CONTEXT
What to understand
Deserialization converts stored or transmitted data back into application objects. Risk arises when an application trusts data from an untrusted source or uses formats and libraries that permit unexpected behavior during that conversion.
02
HIGH-LEVEL CONCEPT
How the risk can develop
This is a conceptual overview, not a procedure for reproducing an attack.
- Serialized data from an external source crosses a trust boundary.
- A parser accepts data beyond the application's expected schema.
- Application behavior may diverge from the intended data-handling path.
03
WHY IT MATTERS
Potential impact
Depending on the format, library, and application context, unsafe handling may cause data exposure, application instability, or unintended behavior.
04
BE AWARE
Signals to monitor
- Unexpected serialized payload sizes or formats in logs and telemetry.
- Deserialization exceptions or unusual object types from external inputs.
- Changes in behavior following updates to data exchanged with an external system.
05
PUT DEFENSE FIRST
Recommended defenses
- 01Prefer simple, schema-validated data formats for untrusted inputs.
- 02Avoid general-purpose object deserialization when a narrowly defined data-transfer model is sufficient.
- 03Validate size, structure, and allowed fields before processing external data.
- 04Keep serialization libraries current and monitor advisories relevant to the deployed stack.