Software or Data Integrity Failures
Code or data accepted from untrusted sources without integrity verification.
What it is
Software or Data Integrity Failures retains its position at A08 in 2025. It covers any path by which untrusted code or data flows into a trust boundary without verification. Examples include insecure deserialization (where an attacker-controlled byte stream is reconstructed into application objects), CI/CD pipelines that trust unauthenticated artifact sources, auto-update mechanisms that fetch updates over insecure channels, and dependencies installed from registries without integrity hashes. The category overlaps with A03:2025 Software Supply Chain Failures but focuses specifically on the integrity-verification gap rather than the broader supply-chain context.
Common patterns
- •Python pickle.load on data from HTTP requests, message queues, or cache backends.
- •Java ObjectInputStream.readObject on data from network sources (gadget-chain RCE).
- •.NET BinaryFormatter on attacker-controlled bytes.
- •PHP unserialize on cookie or query-string values.
- •CI/CD steps that fetch scripts from URLs without hash pinning or signature verification.
- •Package installations without lockfile or integrity-hash verification.
What Deva detects
Deva flags every call site that deserializes data via a format capable of arbitrary class instantiation (pickle, ObjectInputStream, BinaryFormatter, NetDataContractSerializer, PHP unserialize, Ruby Marshal, YAML.load without SafeLoader). Findings include the upstream data source and a suggested format alternative (JSON, MessagePack, Protobuf) that does not deserialize into application objects.
CWE detection guides
Real-world examples
| Year | Incident | What happened |
|---|---|---|
| 2020 | SolarWinds Orion (multiple victims) | Attackers gained access to SolarWinds' build pipeline and injected malicious code into Orion update packages. The packages were signed with SolarWinds' legitimate signing key and distributed through the normal update channel. Thousands of organizations including US federal agencies installed the trojaned updates. |
| 2015 | Apache Commons Collections deserialization | Discovery of gadget chains in widely-used Java libraries (Apache Commons Collections, Spring AOP) enabled reliable remote code execution against any application that deserialized Java objects from network sources. The class of exploit affected JBoss, WebSphere, WebLogic, and Jenkins among many other Java applications. |
Compliance framework impact
- •NIST 800-53 SI-7 Software, Firmware, and Information Integrity
- •PCI-DSS v4.0 Req 6.5.5 Improper error handling and data integrity
- •CMMC 2.0 SI.L2-3.14.1 Flaw remediation, SI.L2-3.14.4 Update protections
Deva detects the software or data integrity failures patterns above at write time, alongside 970+ other CWE rules, with fixes mapped to the compliance controls each finding touches.