Java Deserialization Vulnerability in Apache Causeway

CVE-2025-64408

What is CVE-2025-64408?

The Apache Causeway framework is susceptible to Java deserialization vulnerabilities that can be exploited for remote code execution (RCE). This flaw allows authenticated attackers to manipulate user-controllable URL parameters, enabling them to execute arbitrary code with the privileges of the application. All applications utilizing Causeway's ViewModel functionality are affected, highlighting the critical need for users to upgrade to version 3.5.0 or later in order to mitigate the risk posed by this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References