Tag

java-deserialize

Safeguard articles tagged "java-deserialize" — guides, analysis, and best practices for software supply chain and application security.

1 article

Security

Serialize vs Deserialize: A Practical Comparison and Why Deserialization Is the Risky One

Serialize turns an object into bytes; deserialize turns bytes back into an object. The comparison matters for security because deserializing untrusted data in Java has caused some of the worst RCE bugs on record.

Mar 27, 20256 min read