CVE-2025-64408
Medium · 6.3Apache Causeway vulnerable to deserialization in Java
CVSS
6.3
EPSS
11.6%
Published
Nov 19, 2025
CISA due date
—
The record
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.causeway.commons:causeway-commons | 0 | 3.5.0 |
| Maven | org.apache.causeway.core:causeway-applib | 0 | 3.5.0 |
| Maven | org.apache.causeway.core:causeway-core | 0 | 3.5.0 |
| Maven | org.apache.causeway.viewer:causeway-viewer-wicket | 0 | 3.5.0 |
Related vulnerabilities
- GHSA-wq4c-57mh-5f7g Apache Causeway vulnerable to deserialization in Java Same vulnerability
- CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection… CWE-502
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-502
- CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the MongoDB PHP… CWE-502
- CVE-2026-62107 Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions. CWE-502
- CVE-2026-62103 Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. CWE-502
- CVE-2026-62105 Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. CWE-502
- CVE-2026-73699 FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows… CWE-502