CVE-2025-27528

critical · 9.1

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747

9.1

CVSS

0.7%

EPSS (exploit prob.)

51st

EPSS percentile

2025-05-28

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
apache	inlong	>= 1.13.0, < 2.2.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/apache/inlong/pull/11747
https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj
http://www.openwall.com/lists/oss-security/2025/05/28/3

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-27528