Tag

java-deserialization-vulnerability

Safeguard articles tagged "java-deserialization-vulnerability" — guides, analysis, and best practices for software supply chain and application security.

1 article

Vulnerabilities

The SnakeYAML Deserialization Vulnerability, Explained

SnakeYAML's default Constructor could instantiate arbitrary Java classes from YAML input — CVE-2022-1471 turned a config-parsing library into a remote code execution path.

Jun 19, 20245 min read