CVE-2025-64408

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-64408
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64408.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-64408
Aliases
Published
2025-11-19T10:32:05.808Z
Modified
2026-07-08T08:12:19.916855647Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Apache Causeway: Java deserialization vulnerability to authenticated attackers
Details

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "3.4.0"
                },
                {
                    "introduced": "4.0.0-M1"
                },
                {
                    "last_affected": "4.0.0-M1"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64408.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-502"
    ]
}
References

Affected packages

Git / github.com/apache/causeway

Affected ranges

Type
GIT
Repo
https://github.com/apache/causeway
Events
Introduced
75d21bcb30d85bc37d9115fc14cc35ce4271b986
Fixed
66e985d5c85b84e8147d4339c17950a48ee09c2c
Introduced
a65669305380641490c6137d7b3d6b4a2fbf6c4d
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:causeway:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:causeway:4.0.0:m1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "3.5.0"
        },
        {
            "introduced": "4.0.0-m1"
        },
        {
            "last_affected": "4.0.0-m1"
        }
    ]
}

Affected versions

4.*
4.0.0-m1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64408.json"