Weaknesses of type CWE-502

2,661 results

Desserialização de dados não confiáveis

A aplicação reconstrói objetos a partir de dados serializados (JSON, XML, binário) recebidos de fontes externas sem validar adequadamente se o conteúdo é legítimo. Um atacante pode injetar código malicioso ou objetos especialmente crafted que são executados durante a desserialização, comprometendo toda a aplicação.

Example

Um servidor Java desserializa objetos recebidos em requisições HTTP usando ObjectInputStream, sem verificar a classe ou origem dos dados. Um atacante envia um objeto serializado contendo uma cadeia de gadgets (RCE via biblioteca como Apache Commons Collections) que é executada assim que o objeto é reconstruído em memória.

How to mitigate

Valide e liste explicitamente as classes que podem ser desserializadas (whitelist). Para JSON/XML, use parsers que não executem código (como JSON simples, evite eval). Considere alternativas seguras como Protocol Buffers ou MessagePack, e mantenha bibliotecas críticas atualizadas.

CVE-2026-53435HIGHIn Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in JEPSS 2.2%CVE-2026-27830HIGHc3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString propertyEPSS 2.1%CVE-2021-29476CRITICALInsecure Deserialization of untrusted data in rmccue/requestsEPSS 2.1%CVE-2024-30042HIGHMicrosoft Excel Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-23734HIGHDeserialization of Untrusted Data vulnerability in GitHub Enterprise Server leading to Remote Code ExecutionEPSS 2.1%CVE-2026-40368HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 2.1%CVE-2023-29215CRITICALApache Linkis JDBC EngineCon has a deserialization command executionEPSS 2.1%CVE-2023-29216CRITICALApache Linkis DatasourceManager module has a deserialization command executionEPSS 2.1%CVE-2025-24447CRITICALColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 2.1%CVE-2024-11039HIGHDeserialization of Untrusted Data in binary-husky/gpt_academicEPSS 2.1%CVE-2020-26207HIGHUnsafe deserialization in DatabaseSchemaViewerEPSS 2.1%CVE-2025-30284HIGHColdFusion | Deserialization of Untrusted Data (CWE-502)EPSS 2.1%CVE-2023-34040MEDIUMJava Deserialization vulnerability in Spring-Kafka When Improperly ConfiguredEPSS 2.1%CVE-2025-54539CRITICALApache ActiveMQ NMS AMQP Client: Deserialization of Untrusted DataEPSS 2.1%CVE-2026-45247CRITICALMirasvit Cache Warmer for Magento < 1.11.12 PHP Object InjectionEPSS 2.1%KEVCVE-2024-3568LOWArbitrary Code Execution via Deserialization in huggingface/transformersEPSS 2.1%CVE-2022-31604CRITICALNVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via piEPSS 2.1%CVE-2022-31605CRITICALNVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.EPSS 2.1%CVE-2021-24384—JoomSport < 5.1.8 - Unauthenticated PHP Object InjectionEPSS 2.1%CVE-2020-10740MEDIUMA vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise ApEPSS 2.1%