CWE-502: Deserialization of Untrusted Data

Code Examples & CVEs

Demonstrative Examples

This code snippet deserializes an object from a file and uses it as a UI button:

This code does not attempt to verify the source or contents of the file before deserializing it. An attacker may be able to replace the intended file with a file that contains arbitrary malicious code which will be executed when the button is pressed.

BadJava

try {File file = new File("object.obj");ObjectInputStream in = new ObjectInputStream(new FileInputStream(file));javax.swing.JButton button = (javax.swing.JButton) in.readObject();in.close();}

This code snippet deserializes an object from a file and uses it as a UI button:

GoodJava

private final void readObject(ObjectInputStream in) throws java.io.IOException {throw new java.io.IOException("Cannot be deserialized"); }

In Python, the Pickle library handles the serialization and deserialization processes. In this example derived from [REF-467], the code receives and parses data, and afterwards tries to authenticate a user based on validating a token.

Unfortunately, the code does not verify that the incoming data is legitimate. An attacker can construct a illegitimate, serialized object "AuthToken" that instantiates one of Python's subprocesses to execute arbitrary commands. For instance,the attacker could construct a pickle that leverages Python's subprocess module, which spawns new processes and includes a number of arguments for various uses. Since Pickle allows objects to define the process for how they should be unpickled, the attacker can direct the unpickle process to call Popen in the subprocess module and execute /bin/sh.

BadPython

try {                         class ExampleProtocol(protocol.Protocol):def dataReceived(self, data):                            # Code that would be here would parse the incoming data# After receiving headers, call confirmAuth() to authenticate                            def confirmAuth(self, headers):try:token = cPickle.loads(base64.b64decode(headers['AuthToken']))if not check_hmac(token['signature'], token['data'], getSecretKey()):raise AuthFailself.secure_data = token['data']except:raise AuthFail                      }

Observed CVE Examples (13)

CVE-2024-37052

insecure deserialization in platform for managing AI/ML applications and models allows code execution via a crafted pickled object in a model file

View Details

CVE-2024-37288

deserialization of untrusted YAML data in dashboard for data query and visualization of Elasticsearch data

View Details

CVE-2024-9314

PHP object injection in WordPress plugin for AI-based SEO

View Details

CVE-2019-12799

chain: bypass of untrusted deserialization issue (CWE-502) by using an assumed-trusted class (CWE-183)

View Details

CVE-2015-8103

Deserialization issue in commonly-used Java library allows remote execution.

View Details

CVE-2015-4852

Deserialization issue in commonly-used Java library allows remote execution.

View Details

CVE-2013-1465

Use of PHP unserialize function on untrusted input allows attacker to modify application configuration.

View Details

CVE-2012-3527

Use of PHP unserialize function on untrusted input in content management system might allow code execution.

View Details

CVE-2012-0911

Use of PHP unserialize function on untrusted input in content management system allows code execution using a crafted cookie value.

View Details

CVE-2012-0911

Content management system written in PHP allows unserialize of arbitrary objects, possibly allowing code execution.

View Details

CVE-2011-2520

Python script allows local users to execute code via pickled data.

View Details

CVE-2012-4406

Unsafe deserialization using pickle in a Python script.

View Details

CVE-2003-0791

Web browser allows execution of native methods via a crafted string to a JavaScript function that deserializes the string.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-502 trust boundary

MITRE identifies automated static analysis as applicable detection approaches. Use them to locate native object deserialization at trust boundaries and inspect type resolution, gadget availability, integrity checks, and callbacks executed while rebuilding object graphs. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-502: detection methods and operational guidance — MITRE CWE

Do not deserialize attacker-controlled object graphs

Prefer a simple data format over native object serialization when crossing a trust boundary. Verify integrity or authenticity before deserialization, allow only expected data types, and reject unexpected polymorphic or type metadata. If legacy deserialization cannot be removed, isolate it in a low-privilege process and monitor for unexpected classes or execution paths.

Deserialization Cheat Sheet — OWASP Foundation

Apply lessons from CVE-2025-49113 in Roundcube Webmail

NVD maps CVE-2025-49113 to CWE-502; an authenticated user could influence a URL parameter that reached unsafe deserialization and achieve remote code execution. Use the case to trace seemingly ordinary settings and upload parameters into serialization APIs, remove native object parsing, and test authenticated low-privilege paths for gadget execution.

CVE-2025-49113 Detail — NIST National Vulnerability Database

Prioritize CWE-502 using its 2025 CWE Top 25 evidence

CWE-502 ranked #15 in the 2025 CWE Top 25 with a score of 5.23. The ranking table recorded 11 mapped vulnerabilities in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software Weaknesses — MITRE CWE

Constrain and exercise Java deserialization filters

For Java native serialization that cannot yet be removed, define allowlists and graph limits with process-wide or stream-specific filters, then test expected classes, rejected classes, proxies, arrays, depth, references, and byte limits. Exercise nested and oversized graphs in isolation, verify rejection occurs before dangerous callbacks, and confirm every deserialization entry point installs the intended filter.

Java Serialization Filtering — Oracle Java

Frequently Asked Questions

What is CWE-502: Deserialization of Untrusted Data?+

CWE-502: Deserialization of Untrusted Data is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Is CWE-502 in the CWE Top 25 Most Dangerous Software Weaknesses?+

Yes. CWE-502 ranked #19 in the CWE Top 25 for 2024, associated with 237 CVEs that year. The CWE Top 25 highlights the most common and impactful software weaknesses based on real-world vulnerability data.

What are the security consequences of Deserialization of Untrusted Data?+

If exploited, CWE-502 (Deserialization of Untrusted Data) it can compromise Integrity, Availability and Other, leading to outcomes such as Modify Application Data, Unexpected State, DoS: Resource Consumption (CPU) and Varies by Context.

How do you prevent or mitigate Deserialization of Untrusted Data?+

Recommended mitigations for CWE-502 include: If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified. When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe. Explicitly define a final object() to prevent deserialization.

Which programming languages are affected by Deserialization of Untrusted Data?+

CWE-502 commonly affects Java, Ruby, PHP, Python and JavaScript. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Deserialization of Untrusted Data?+

MITRE documents real CVEs mapped to CWE-502, including CVE-2024-37052, CVE-2024-37288, CVE-2024-9314, CVE-2019-12799 and CVE-2015-8103. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-502 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-502: Deserialization of Untrusted Data

Technical Details

Applicable To

🏆 CWE Top 25 Historical Ranking

Security Consequences

Scope

Impact

Scope

Impact

Scope

Impact

Mitigation Strategies

Phase

Description

Phase

Description

Phase

Description

Phase

Description

Phase

Description

Phase

Description

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (13)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Combine review and analysis around the CWE-502 trust boundary

Do not deserialize attacker-controlled object graphs

Apply lessons from CVE-2025-49113 in Roundcube Webmail

Prioritize CWE-502 using its 2025 CWE Top 25 evidence

Constrain and exercise Java deserialization filters

Frequently Asked Questions

Learn More