Abstract: In this paper we proposed a method of vulnerability mining based on Abstract Syntax Tree (AST), which can automatic detect defects in the mainstream frameworks of Java Json deserialization.

UltraJSON's architecture is fundamentally ill-suited to making changes without risk of introducing new security vulnerabilities. As a result, this library has been put into a maintenance-only mode.