Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-27528

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747

Published

2025-05-28T08:15:21.830

Last Modified

2025-06-03T15:36:47.120

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

Weaknesses

Type: Secondary
CWE-502

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apache	inlong	< 2.2.0	Yes

References

https://github.com/apache/inlong/pull/11747 Issue Tracking ([email protected])
https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj Vendor Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2025/05/28/3 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)