I got the following message from Fortify static code analyser.

Incorrect serialization and de-serialization can lead to unpredictable behavior and cause denial of service attacks.

Can anyone explain how this can be serialization and de-serialization can lead to DoS?


If the serialized data is provided by an untrusted client, it can be manipulated.

Let's assume there is a linked list. The attacker can add a huge number of entries.

It may even be possible to created invalid serialized data. For example the length field of an array can be set to a very huge number. The server will allocate enough memory to store all elements, although they are never sent.

In some circumstances it is possible to trigger code that allocates other resources such as threads or files.

Last but not least there have been classes with bugs in their serialization code.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.