CVE-2025-64408CWE-502insecure-deserialization

CVE-2025-64408

Medium · published November 19, 2025

CVSS v3.1
6.3
EPSS
12%
Percentile
96.0
In the wild
Unconfirmed
What it is

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.11555 · 96.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-11-19T16:15Z
Affected products (2)
ProductVersionsFixed in
apache/causeway≥ 2.0.0, < 3.5.03.5.0
apache/causewayall versions—
References (2)
https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b · [email protected]http://www.openwall.com/lists/oss-security/2025/11/19/1 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 19 NOV 10:32Z
    Apache Causeway: Java deserialization vulnerability to authenticated attackers
    cvelistv5