8 November 2015

The Java Deserialization Bug

By carlfish on 8 November 2015

Arbitrary object deserialization (or marshalling, or un-pickling, whatever your language calls it) is inherently unsafe, and should never be performed on untrusted data. →