CVE-2025-27526

Published: May 28, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747

Affected (1)

Products: Apache: Inlong

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Inlong	From 1.13.0 to 2.2.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

https://github.com/apache/inlong/pull/11747

Source: security@apache.org

Issue Tracking

https://lists.apache.org/thread/4t4sqscm7xdqn883dyjy40qk6ncf26xf

Source: security@apache.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2025/05/28/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.