---
id: CVE-2025-64408
title: 'Apache Causeway: Java deserialization vulnerability to authenticated attackers'
summary: "Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through\_user-controllable URL parameters. These vulnerabilities affect all\_applications using Causeway's ViewModel functionality and can be…"
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cvssSource: adp
cwe:
  - CWE-502
vendor: Apache Software Foundation
product: 'org.apache.causeway:*'
affected:
  - 'org.apache.causeway:* >= 2.0.0 <= 3.4.0'
  - 'org.apache.causeway:* 4.0.0-M1'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-11-20T04:55:23.008086Z'
published: '2025-11-19'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:03:07.444Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-64408'
references:
  - url: 'https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b'
tags:
  - cve.org
epss: 0.11555
epssPercentile: 0.9605
ingestedAt: '2026-11-05T20:33:06.570Z'
---

## Overview

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

## Affected

- `org.apache.causeway:* >= 2.0.0 <= 3.4.0`
- `org.apache.causeway:* 4.0.0-M1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.