CVE-2025-27522

Published: May 28, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11732

Affected (1)

Products: Apache: Inlong

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Inlong	From 1.13.0 to 2.2.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

https://github.com/apache/inlong/pull/11732

Source: security@apache.org

Issue Tracking

https://lists.apache.org/thread/s4dnmq3gwcjocxf85qk190knlzd26jby

Source: security@apache.org

Vendor Advisory

https://github.com/apache/inlong/commit/86c893cfd8f7ba9ffce5d20abef6cd360f502fdf

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.