CVE-2025-64408: Apache Causeway vulnerable to deserialization in Java
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. This issue affects all current versions.
Published Nov 19, 2025
Affected packages
org.apache.causeway.commons:causeway-commons
- Ecosystem
- Maven
- Affected
- < 3.5.0
- Fixed in
- 3.5.0
- Check
mvn dependency:tree -Dincludes=org.apache.causeway.commons:causeway-commons
org.apache.causeway.core:causeway-applib
- Ecosystem
- Maven
- Affected
- < 3.5.0
- Fixed in
- 3.5.0
- Check
mvn dependency:tree -Dincludes=org.apache.causeway.core:causeway-applib
org.apache.causeway.core:causeway-core
- Ecosystem
- Maven
- Affected
- < 3.5.0
- Fixed in
- 3.5.0
- Check
mvn dependency:tree -Dincludes=org.apache.causeway.core:causeway-core
org.apache.causeway.viewer:causeway-viewer-wicket
- Ecosystem
- Maven
- Affected
- < 3.5.0
- Fixed in
- 3.5.0
- Check
mvn dependency:tree -Dincludes=org.apache.causeway.viewer:causeway-viewer-wicket
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges.
This issue affects all current versions.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-64408
- https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b
- https://github.com/apache/causeway/commit/bef00f58d2a2cba9a45230c9d117a0327e4c7038
- https://github.com/apache/causeway/commit/e66290fe9be87aa0e4c5dc55bce1993a54330624
- https://github.com/apache/causeway/commit/e6bf00c63c33cfa894a19d6122526a1aec227d14
- https://issues.apache.org/jira/browse/CAUSEWAY-3939
- https://github.com/advisories/GHSA-wq4c-57mh-5f7g
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology