Security Resilience

CWE · MITRE source

CWE-502Deserialization of Untrusted Data

Abstraction: Base · CVEs in our corpus: 3,476

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Last updated: 16 October 2026 10:19 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A08:2025 Software or Data Integrity Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SI-10 Information Input Validation
  • SI-3 Malicious Code Protection
  • SI-7 Software, Firmware, and Information Integrity
  • CA-8 Penetration Testing
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (7)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
SI-10Information Input ValidationSIgraded mostly Validates or rejects untrusted serialized data before deserialization occurs.
SI-7Software, Firmware, and Information IntegritySIgraded partial Integrity verification of serialized information can detect tampering before deserialization occurs.
SA-11Developer Testing and EvaluationSAgraded mostly Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
SI-3Malicious Code ProtectionSIIdentifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
CA-8Penetration TestingCAPenetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
SC-44Detonation ChambersSCUntrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
SR-4ProvenanceSRProvenance of associated data allows detection of untrusted sources before deserialization or processing occurs.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-44228 KEV 10.010.01.00002021-12-10
CVE-2023-40044 KEV 10.010.00.90352023-09-27
CVE-2023-46604 KEV 10.010.00.99892023-10-27
CVE-2025-10035 KEV 10.010.00.99802025-09-18
CVE-2025-55182 KEV 10.010.00.99802025-12-03
CVE-2026-20131 KEV 10.010.00.43172026-03-04
CVE-2015-4852 KEV 9.99.80.94992015-11-18
CVE-2015-8103 9.99.80.86712015-11-25
CVE-2015-7450 KEV 9.99.80.97762016-01-02
CVE-2017-5645 9.99.80.89792017-04-17
CVE-2017-3066 KEV 9.99.80.90602017-04-27
CVE-2017-12149 KEV 9.99.80.90712017-10-04
CVE-2015-7501 9.99.80.85562017-11-09
CVE-2017-1000353 KEV 9.99.80.99682018-01-29
CVE-2017-12557 9.99.80.79812018-02-15
CVE-2018-0147 KEV 9.99.80.18212018-03-08
CVE-2018-2628 KEV 9.99.80.99962018-04-19
CVE-2018-4939 KEV 9.99.80.61992018-05-19
CVE-2018-3245 9.99.80.94282018-10-17
CVE-2018-15381 9.99.80.87252018-11-08
CVE-2018-1000861 KEV 9.99.80.98332018-12-10
CVE-2019-0192 9.99.80.78232019-03-07
CVE-2018-19276 9.99.80.98712019-03-21
CVE-2019-10068 KEV 9.99.80.95072019-03-26
CVE-2019-7214 9.99.80.84822019-04-24