What is deserialization of untrusted data?
Deserialization of untrusted data
Azərbaycanca: Etibarlı olmayan verilənlərin deserializasiyası
How it works
Deserialization of untrusted data vulnerability allows attackers to perform object injection or other malicious activities, particularly during Java lambda deserialization or other deserialization mechanisms.
Defense checklist5
- 01
Validate and restrict deserialization of data from untrusted sources
- 02
Implement whitelist or class-registration checks during deserialization
- 03
Use secure deserialization libraries
- 04
Regularly update systems and software
- 05
Perform security audits and penetration testing
Real-world evidence
CVE-2026-64606 (Java lambda deserialization), CVE-2026-21655 (Johnson Control victor on Windows), CVE-2026-18642 (TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock) incidents demonstrate the security risks associated with deserialization of untrusted data.
Sources
- CVE-2026-64606: Deserialization of untrusted data vulnerability that may allow class-registration checks tnvd
- CVE-2026-21655: Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allownvd
- CVE-2026-18642: Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Renvd
Other attack types
See also6
This guide is AI-written from the real incident sources skopnix collected — the examples above are drawn from those cited items, nothing is invented.