VulnerabilityAnalyzed

CVE-2025-27528

Deserialization of Untrusted Data vulnerability in Apache InLong.

CRITICAL 9.1EPSS 0.68%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.68%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.68% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: apache/inlong
Source: security@apache.org

References

https://github.com/apache/inlong/pull/11747Issue Tracking
https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgjVendor Advisory
http://www.openwall.com/lists/oss-security/2025/05/28/3Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.