{"action":"Upgrade org.apache.causeway.commons:causeway-commons to 3.5.0 or later.","affected":[{"fixed":"3.5.0","introduced":"0"}],"component":"org.apache.causeway.commons:causeway-commons","cve_ids":["CVE-2025-64408"],"ecosystem":"Maven","epss":0.11555,"exploited":false,"fixed_versions":["3.5.0"],"ghsa_id":"GHSA-wq4c-57mh-5f7g","id":"tcs_01M5N9GYR4QEY2G2PNJD8FD9YM","modified_at":"2025-11-20T14:43:59.428288Z","published_at":"2025-11-19T12:30:21Z","references":["https://osv.dev/vulnerability/GHSA-wq4c-57mh-5f7g","https://nvd.nist.gov/vuln/detail/CVE-2025-64408","https://github.com/apache/causeway/commit/bef00f58d2a2cba9a45230c9d117a0327e4c7038","https://github.com/apache/causeway/commit/e66290fe9be87aa0e4c5dc55bce1993a54330624","https://github.com/apache/causeway/commit/e6bf00c63c33cfa894a19d6122526a1aec227d14","https://github.com/apache/causeway","https://issues.apache.org/jira/browse/CAUSEWAY-3939","https://lists.apache.org/thread/rjlg4spqhmgy1xgq9wq5h2tfnq4pm70b","http://www.openwall.com/lists/oss-security/2025/11/19/1"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-wq4c-57mh-5f7g","url":"https://osv.dev/vulnerability/GHSA-wq4c-57mh-5f7g"}],"summary":"Apache Causeway vulnerable to deserialization in Java"}