CVE-2025-64408— Apache Causeway: Java deserialization vulnerability to authenticated attackers
Quick assessment
Affected
Apache Software Foundation Apache Causeway
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Causeway是Apache基金会的一个Java的快速应用程序开发框架。 Apache Causeway存在安全漏洞，该漏洞源于用户可控URL参数存在Java反序列化漏洞，可能导致远程代码执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-64408
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Causeway: Java deserialization vulnerability to authenticated attackers
Source: CVE Program / CVE List V5
Vulnerability Description
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.
This issue affects all current versions.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Causeway 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Causeway是Apache基金会的一个Java的快速应用程序开发框架。 Apache Causeway存在安全漏洞，该漏洞源于用户可控URL参数存在Java反序列化漏洞，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Causeway | 2.0.0 ~ 3.4.0 | - |
|
II. Public POCs for CVE-2025-64408
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-64408
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-82617
Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in -
CVE-2026-67211
Apache OpenNLP: OOM DoS via Unbounded Array Allocation in Sy -
CVE-2026-80354
Apache Camel K: Camel K Builder trait mavenProfiles ValueSou -
CVE-2026-80351
Apache Camel K: Camel K Tenant repositories reach Maven exec -
CVE-2026-80352
Apache Camel K: Camel K Master trait serviceAccountName YAML
Same weakness: CWE-502
-
CVE-2026-90777
ESPnet before 202609 Remote Code Execution via Unsafe Deseri -
CVE-2026-90490
lenve vhr MailReceiver deserialization -
CVE-2026-78175
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object -
CVE-2026-78006
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object I -
CVE-2026-87719
Deserialization of Untrusted Data in GitLab
V. Comments for CVE-2025-64408
No comments yet