Critical Apache Causeway RCE Flaw (CVE-2025-64408) Allows Authenticated Code Execution via Java Deserialization

Apache Causeway has been found to contain a critical Java deserialization flaw, CVE-2025-64408, that could let authenticated attackers execute arbitrary code within affected applications. The vulnerability is reachable via user-controlled URL parameters and can reconstruct object graphs, enabling remote code execution with the privileges of the application process. It affects all implementations using Causeway’s ViewModel functionality across multiple major versions, specifically 2.0.0 to 3.4.0 and 4.0.0-M1.

According to the advisory, the flaw is a critical-severity remote code execution risk. The Apache Causeway team has released version 3.5.0, which fully addresses the vulnerability. The article, published on 20 November 2025, notes that authenticated attackers could exploit the issue unless systems are updated to the patched release.