CVE-2019-18935

Summary

Insecure deserialization occurs when an application reconstructs objects from attacker-controlled serialized data without validating it, so the deserializer instantiates arbitrary types and invokes their lifecycle/magic methods (Java readObject, .NET ISerializable/SetObjectData, PHP __wakeup); attackers chain these side effects through pre-existing library classes, or gadget chains, to reach a sink that executes code without the application ever calling a dangerous function directly. It maps to OWASP A08:2021 Software and Data Integrity Failures (CWE-502). The 2015 disclosure by Chris Frohoff and Gabriel Lawrence ('Marshalling Pickles') and the ysoserial tool weaponized Apache Commons Collections gadget chains via InvokerTransformer, exposing thousands of Java apps. A landmark exploited case is Telerik UI for ASP.NET AJAX CVE-2019-18935 (CVSS 9.8), a .NET deserialization flaw in the RadAsyncUpload component that CISA reported (AA23-074A) was used by threat actors to breach a US federal civilian agency's IIS server between November 2022 and January 2023.

Severity

critical

EPSS

99.7% (p100)

CWE

CWE-502

Also known as

APPSEC-DESERIAL, Insecure Deserialization, ysoserial

Published

2019-11-20

How to avoid it

• Do not deserialize untrusted data with native serializers (Java ObjectInputStream, .NET BinaryFormatter, PHP unserialize).
• Use data-only formats (JSON) with explicit schemas and reject polymorphic type resolution.
• Enforce a strict allowlist of permitted classes during any required deserialization.
• Sign or HMAC serialized payloads and verify integrity before deserializing.
• Keep libraries patched, remove known gadget classes from the classpath, and run with least privilege.

References

• https://owasp.org/Top10/2021/A08_2021-Software_and_Data_Integrity_Failures/
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a
• https://nvd.nist.gov/vuln/detail/CVE-2019-18935
• https://github.com/frohoff/ysoserial

Related advisories

• CVE-2026-79657 — critical · PyPI/nltk
• CVE-2026-78683 — critical · PyPI/nltk
• CVE-2026-55220 — critical · Packagist/pimcore/pimcore
• CVE-2026-62263 — critical · Maven/org.openidentityplatform.openam:openam-auth-webauthn
• CVE-2026-59940 — critical · npm/seroval
• CVE-2026-52777 — critical · Packagist/yeswiki/yeswiki
• CVE-2026-39832 — critical · Go/golang.org/x/crypto/ssh/agent
• CVE-2026-45051 — critical · Maven/org.openidentityplatform.openam:openam-auth-webauthn

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity