What is CVE-2025-64408?

CVE-2025-64408 is a medium-severity vulnerability in Apache Causeway, classified under Deserialization of Untrusted Data. CVSS score: 6.3/10. Published 2025-11-19.

How severe is CVE-2025-64408?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Deserialization in Apache Causeway

CVE-2025-64408

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Vulnerability class: Insecure Deserialization

EPSS: 0.106 (95.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Apache Causeway — versions 4.0.0
Apache Software Foundation Causeway — versions 2.0.0, 4.0.0-M1

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2025-64408?: CVE-2025-64408 is a medium-severity vulnerability in Apache Causeway, classified under Deserialization of Untrusted Data. CVSS score: 6.3/10. Published 2025-11-19.
How severe is CVE-2025-64408?: Medium severity. CVSS v3 base score is 6.3 out of 10.