On this page
Atomicorp WAF Rule 344380
Rule Summary
- Rule ID: 344380
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Deserialization gadget chain detected (Java/.NET)
- Observed CWEs: CWE-20 (6), CWE-22 (1), CWE-73 (1), CWE-77 (1), CWE-78 (1), CWE-94 (3), CWE-96 (1), CWE-184 (1), CWE-200 (1), CWE-434 (1), CWE-502 (36)
- Revision: 1
- Rule severity: Critical
- Phase: 2 (request body)
- Request surfaces: Request body, Request arguments, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Deserialization gadget chain detected (Java/.NET)” in the request body, request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2026-45829 | ChromaDB Security Vulnerability | ChromaDB | 10.0 (v4.0) | Critical |
| CVE-2026-34838 | Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in AbstractSettingsCollection | group-office | 9.9 (v3.1) | Critical |
| CVE-2015-7501 | Red Hat JBoss - Insecure Deserialization | jboss enterprise application platform | 9.8 (v3.0) | Critical |
| CVE-2017-18349 | Fastjson 1.2.24 Deserialization Remote Command Execution (CVE-2017-18349) | fastjson | 9.8 (v3.0) | Critical |
| CVE-2017-7525 | Jackson-databind Deserialization Remote Command Execution (CVE-2017-7525) | jackson-databind | 9.8 (v3.1) | Critical |
| CVE-2019-17564 | Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization | dubbo | 9.8 (v3.1) | Critical |
| CVE-2020-10189 | ManageEngine Desktop Central Java Deserialization | manageengine desktop central | 9.8 (v3.1) | Critical |
| CVE-2021-23758 | AjaxPro Deserialization Remote Code Execution | ajaxpro.2 | 9.8 (v3.1) | Critical |
| CVE-2023-29300 | Adobe ColdFusion XML Deserialization Leads to RCE (CVE-2023-29300) | coldfusion | 9.8 (v3.1) | Critical |
| CVE-2023-37679 | Mirth Connect Deserialization RCE | mirth connect | 9.8 (v3.1) | Critical |
| CVE-2023-38203 | Adobe ColdFusion - Deserialization of Untrusted Data | coldfusion | 9.8 (v3.1) | Critical |
| CVE-2023-43208 | Mirth Connect Deserialization RCE | mirth connect | 9.8 (v3.1) | Critical |
| CVE-2025-66455 | LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/con | lmdeploy | 9.8 (v3.1) | Critical |
| CVE-2026-115806 | Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Repla | Prime Mover – Backup and Migration | 9.8 (v3.1) | Critical |
| CVE-2026-19912 | Kaltura HTML5 Video Player, html5 library Arbitrary Code Execution Vulnerability | Kaltura HTML5 Video Player, html5 library | 9.8 (v3.1) | Critical |
| CVE-2025-34292 | BeWelcome/Rox PHP Object Injection RCE | Rox | 9.4 (v4.0) | Critical |
| CVE-2023-54398 | Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet | U8 Cloud | 9.3 (v4.0) | Critical |
| CVE-2025-66571 | UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection | UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 | 9.3 (v4.0) | Critical |
| CVE-2026-10042 | manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model | manga-image-translator | 9.2 (v4.0) | Critical |
| CVE-2026-87930 | MaxSite CMS through 109.6 PHP Object Injection via ci_session | MaxSite CMS | 9.2 (v4.0) | Critical |
| CVE-2021-21351 | XStream Deserialization Remote Command Execution (CVE-2021-21351) | oncommand insight | 9.1 (v3.1) | Critical |
| CVE-2026-47168 | EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params | espocrm | 9.1 (v3.1) | Critical |
| CVE-2025-5086 | Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization | delmia apriso | 9.0 (v3.1) | Critical |
| CVE-2026-14602 | Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter | Remote API | 9.0 (v3.1) | Critical |
| CVE-2023-2288 | Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization | otter | 8.8 (v3.1) | High |
| CVE-2026-113779 | pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission | pfSense-pkg-RESTAPI | 8.8 (v3.1) | High |
| CVE-2026-8365 | Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy | Blocksy | 8.8 (v3.1) | High |
| CVE-2026-47722 | nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml | nebula-mesh | 8.7 (v4.0) | High |
| CVE-2026-71981 | Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter | cypht | 8.7 (v4.0) | High |
| CVE-2026-29001 | TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization | TastyIgniter | 8.6 (v4.0) | High |
| CVE-2020-1147 | SharePoint DataSet / DataTable Deserialization | .net core | 7.8 (v3.1) | High |
| CVE-2026-93872 | Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter | Cotonti | 7.7 (v4.0) | High |
| CVE-2025-63950 | twittodon Unsafe Deserialization Vulnerability | twittodon | 7.5 (v3.1) | High |
| CVE-2025-63951 | phoniebox Unsafe Deserialization Vulnerability | phoniebox | 7.5 (v3.1) | High |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | Kirki | 7.5 (v3.1) | High |
| CVE-2026-19913 | Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability | Kaltura HTML5 Video Player, html5lib library | 7.5 (v3.1) | High |
| CVE-2026-61686 | SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop | SolidInvoice | 7.5 (v3.1) | High |
| CVE-2026-29782 | OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2 | openstamanager | 7.2 (v3.1) | High |
| CVE-2026-97865 | Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization | Open-Web-Analytics | 6.9 (v4.0) | Medium |
| CVE-2025-7825 | Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation | Schema Plugin For Divi, Gutenberg & Shortcodes | 6.3 (v3.1) | Medium |
| CVE-2025-13439 | Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserializatio | Fancy Product Designer | 5.9 (v3.1) | Medium |
| CVE-2026-16297 | Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import | Clearfy Cache | 4.1 (v3.1) | Medium |
| CVE-2023-3360 | Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection | Weaver Show Posts | 3.3 (v3.1) | Low |
| CVE-2026-90575 | PHPGurukul Small CRM Login Success login.php unserialize deserialization | Small CRM | 2.9 (v4.0) | Low |
| CVE-2025-15438 | PluXml Media Management medias.php __destruct deserialization | pluxml | 2.0 (v4.0) | Low |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.