What is CVE-2025-27531?

CVE-2025-27531 is a critical-severity vulnerability in Apache Inlong, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-06-06.

How severe is CVE-2025-27531?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Deserialization in Apache Inlong

CVE-2025-27531

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.

Vulnerability class: Insecure Deserialization

EPSS: 0.006 (44.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Inlong
Apache Software Foundation Inlong — versions 1.13.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Vendor Advisory)

Frequently asked questions

What is CVE-2025-27531?: CVE-2025-27531 is a critical-severity vulnerability in Apache Inlong, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-06-06.
How severe is CVE-2025-27531?: Critical severity. CVSS v3 base score is 9.8 out of 10.