Java Deserialization Vulnerability in Apache Causeway

CVE-2025-64408

What is CVE-2025-64408?

The Apache Causeway framework is susceptible to Java deserialization vulnerabilities that can be exploited for remote code execution (RCE). This flaw allows authenticated attackers to manipulate user-controllable URL parameters, enabling them to execute arbitrary code with the privileges of the application. All applications utilizing Causeway's ViewModel functionality are affected, highlighting the critical need for users to upgrade to version 3.5.0 or later in order to mitigate the risk posed by this vulnerability.

References