CVE-2025-64408 json
Apache Causeway: Java deserialization vulnerability to authenticated attackers
published 2025-11-19 11 mo ago modified 2026-11-03 5 d ago also EUVD-2025-198152 , GHSA-wq4c-57mh-5f7g
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 11.6%
- EPSS 11.6% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.
This issue affects all current versions.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Patch / fix
- maven org.apache.causeway.commons:causeway-commons 3.5.0
- maven org.apache.causeway.core:causeway-applib 3.5.0
- maven org.apache.causeway.core:causeway-core 3.5.0
- maven org.apache.causeway.viewer:causeway-viewer-wicket 3.5.0
- org.apache.causeway.commons causeway-commons 3.5.0
- org.apache.causeway.core causeway-applib 3.5.0
- apache causeway 3.5.0
- org.apache.causeway.core causeway-core 3.5.0
- org.apache.causeway.viewer causeway-applib 3.5.0
- org.apache.causeway.viewer causeway-viewer-wicket 3.5.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 11 mo ago
Exploit prediction
11.55% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.causeway.commons:causeway-commons | <3.5.0 |
3.5.0 |
| maven | org.apache.causeway.core:causeway-applib | <3.5.0 |
3.5.0 |
| maven | org.apache.causeway.core:causeway-core | <3.5.0 |
3.5.0 |
| maven | org.apache.causeway.viewer:causeway-viewer-wicket | <3.5.0 |
3.5.0 |
Affected products
- Apache Software Foundation Apache Causeway
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/causeway/commit/bef00f58d2a2cba9a45230c9d117a0327e4c7038
web
-
github.com
/apache/causeway/commit/e66290fe9be87aa0e4c5dc55bce1993a54330624
web
-
github.com
/apache/causeway/commit/e6bf00c63c33cfa894a19d6122526a1aec227d14
web
-
lists.apache.org
/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2025/11/19/1
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-64408
advisory
-
github.com
/apache/causeway
package
-
issues.apache.org
/jira/browse/CAUSEWAY-3939
web
Sources
- CVE List CVE-2025-64408
- GitHub Advisory GHSA-wq4c-57mh-5f7g
- NVD CVE-2025-64408
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.