CVE-2025-64408
Apache Causeway: Java deserialization vulnerability to authenticated attackers
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
| CWE | CWE-502 |
| Vendor | apache software foundation |
| Product | apache causeway |
| Published | Nov 19, 2025 |
| Last Updated | Feb 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache causeway
Be the first to know when new medium vulnerabilities affecting apache software foundation apache causeway are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Causeway
2.0.0 ≤ 3.4.0 4.0.0-M1
References
Credits
🔍 Slain Nico