CVEvulnerability
CVE-2025-27528
9.1 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2025-05-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-502
Description
Deserialization of Untrusted Data vulnerability in Apache InLong.
This issue affects Apache InLong: from 1.13.0 through 2.1.0.
This
vulnerability allows attackers to bypass the security mechanisms of InLong
JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/11747
Affected configurations
• apache inlong (>= 1.13.0 < 2.2.0)
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://github.com/apache/inlong/pull/11747 Issue Tracking
- https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/05/28/3 Mailing List, Third Party Advisory