Home/CWE/Deserialization of Untrusted Data
Weakness

Deserialization of Untrusted Data

CWE-502 · Base · Draft

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-913 · Improper Control of Dynamically-Managed Code Resources
Related
PeerOfCWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
◆

Attack Patterns (CAPEC)

1
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-586Object Injection
⚠

CVEs With This Weakness

3,168
A sample of the 3,168 CVEs tagged with this weakness.
CVECVE-2026-8751
CVECVE-2026-8735
CVECVE-2026-8612
CVECVE-2026-7818
CVECVE-2026-7712
CVECVE-2026-7647
CVECVE-2026-7635
CVECVE-2026-7597
CVECVE-2026-7584
CVECVE-2026-7317
CVECVE-2026-7304
CVECVE-2026-7301
◉

Nuclei Scanner Templates

30
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalOracle WebLogic Server - Remote Code Execution
criticalApache ActiveMQ - Remote Code Execution
criticalSeeyon OA Fastjson Remote Code Execution
criticalJoomla! CMS <=3.4.6 - Remote Code Execution
criticalFastjson 1.2.41 - Remote Code Execution
criticalFastjson 1.2.43 - Remote Code Execution
criticalFastjson 1.2.42 - Remote Code Execution
criticalFastjson 1.2.62 - Remote Code Execution
criticalFastjson 1.2.24 - Remote Code Execution
criticalFastjson 1.2.67 - Remote Code Execution
criticalFastjson 1.2.68 - Remote Code Execution
criticalCisco vManage (Log4j) - Remote Code Execution
criticalCisco BroadWorks - Remote Code Execution (Apache Log4j)
criticalCisco WebEx - Remote Code Execution (Apache Log4j)
criticalCisco CloudCenter Suite (Log4j) - Remote Code Execution
criticalCisco Unified Communications - Remote Code Execution (Apache Log4j)
criticalGraylog (Log4j) - Remote Code Execution
criticalFortiPortal - Remote Code Execution (Apache Log4j)
criticalElasticsearch 5 - Remote Code Execution (Apache Log4j)
criticalFlexnet - Remote Code Execution (Apache Log4j)
criticalCitrix XenMobile Server - Remote Code Execution (Apache Log4j)
criticalVlife FastJSON - Remote Code Execution
criticalCitrix XenApp - Remote Code Execution (Apache Log4j)
criticalGoAnywhere Managed File Transfer - Remote Code Execution (Apache Log4j)
criticalVMware VCenter - Remote Code Execution (Apache Log4j)
criticalVMware HCX - Remote Code Execution (Apache Log4j)
criticalVMware Horizon - JNDI Remote Code Execution (Apache Log4j)
criticalVMware NSX - Remote Code Execution (Apache Log4j)
criticalLandray-OA - Remote code Execution
criticalApache Druid - Remote Code Execution (Apache Log4j)
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin