Insecure deserialization happens when software accepts serialized data from an untrusted source and turns it back into objects without enough validation. Serialization formats such as JSON, XML, or binary encodings are often used to move state between clients, services, and servers. If the application trusts that data too much, an attacker can tamper with fields, trigger unexpected object behavior, or reach dangerous code paths.
This matters because deserialization bugs can lead to remote code execution, privilege escalation, data corruption, or denial of service. In real attacks, the attacker usually needs a way to supply crafted data through an API, file upload, message queue, or session token. Defenders reduce risk by avoiding unsafe object deserialization, using strict schemas and allowlists, validating input before parsing, and running services with least privilege. In control-plane software, where the server manages deployments or configuration, a single deserialization flaw can have wide operational impact.