CVE-2025-64408: 
Java vulnerability analysis and mitigation

Apache Causeway has been identified with a critical Java deserialization vulnerability (CVE-2025-64408) discovered on November 19, 2025. The vulnerability affects Apache Causeway versions 2.0.0 through 3.4.0 and 4.0.0-M1, specifically impacting applications using Causeway's ViewModel functionality (Apache List, OSS Security).

The vulnerability stems from Java deserialization flaws that are accessible through user-controllable URL parameters. The issue has been assigned CWE-502 (Deserialization of Untrusted Data) and received a CVSS v3.1 base score of 6.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (NVD, Security Online).

The vulnerability allows authenticated attackers to execute arbitrary code with application privileges through the manipulation of serialized data embedded within application URLs. This affects all implementations using Causeway's ViewModel functionality, a core feature responsible for exposing domain logic through dynamically generated web interfaces and REST APIs (Security Online).

Users are strongly recommended to upgrade to Apache Causeway version 3.5.0, which contains the fix for this vulnerability. This version has been released specifically to address the security issue (OSS Security).